From patchwork Wed Sep 29 12:40:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sumit Saxena X-Patchwork-Id: 12525465 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8964C433F5 for ; Wed, 29 Sep 2021 12:41:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A6AB761406 for ; Wed, 29 Sep 2021 12:41:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343874AbhI2Mm6 (ORCPT ); Wed, 29 Sep 2021 08:42:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343839AbhI2Mm5 (ORCPT ); Wed, 29 Sep 2021 08:42:57 -0400 Received: from mail-pg1-x541.google.com (mail-pg1-x541.google.com [IPv6:2607:f8b0:4864:20::541]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A8A0FC06161C for ; Wed, 29 Sep 2021 05:41:16 -0700 (PDT) Received: by mail-pg1-x541.google.com with SMTP id n18so2539572pgm.12 for ; Wed, 29 Sep 2021 05:41:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=5AxNibumVQwdFWj4YbAxjEyvCaj9DuKN4ka6CCBZ+yY=; b=Uj5ByApOxjJ50YqYxams2yYm2iwHwSlskFLHf/jb5lOcY4bDY+2qakRhjEnyGn77BI 5g4ZjbK36PwY6T4E9VjPOGovf+W+EDM+e+dlVmuQdDC8rob1+V05QQEAmCw2k3M+mzfg K4cEEChgYXX+gq7xrqwimLzsUOeo6MBTzdwcM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=5AxNibumVQwdFWj4YbAxjEyvCaj9DuKN4ka6CCBZ+yY=; b=YBslGuQ2ba2eg8cQHXSt7+pqaENDRo/Kp2X+4jjyAeH+LjOZ2fEwoGV6s1mHyNhdVT bphZI3qvMpZdJkRnwAUWSZyM9ZL4b/EwaQ99lgbMYsZLmPumeFLS0Y6gkTgw5koyf+06 MSQJvzIQAzaLBx/i2kq0n9ZnNmoQgHVlj+22gqUMhxrAGtHrkZnaMUjsNHrcSt7nghI0 esxHn9k/mNBJOQ19pfSQfifYK0+nv8HbcxHvP2rIEyWh7A1C9c7BLtUqefzFjsc5r/Ud vdMB7dumZFjPkkjLR7sf8uusa9Ks6WSF0amVIykENVeZdwvePnUnazuCZDEU4YXV+rs+ 6GDA== X-Gm-Message-State: AOAM5336e9Iz5TBY2WHu5ImE9ABhxkE86lwq+eFs8NGTAxV+tDLGFTRI g8EwwSmn3you8d8VkwwMWZksTKs8m9Oofbvfo0mupApEqP2RdsGky97FqhPQNVrOk/tgQk2K1yC lGZcTWMa44fMaOmwLgEDpTvkiXfFx6FUDVQcn6qXTB1HA+KUuCtfBgVSVnvZci6px8toZyixXX3 IvJlIyFCY= X-Google-Smtp-Source: ABdhPJy6wo03r5Gf23A9Aat/Wgoelf05/7QtAsjBhPtU7txRSJ+8AfB2LMWOn+QER3n816BkBAUQsw== X-Received: by 2002:a63:d351:: with SMTP id u17mr9315667pgi.174.1632919275583; Wed, 29 Sep 2021 05:41:15 -0700 (PDT) Received: from dhcp-10-123-20-83.dhcp.broadcom.net ([192.19.234.250]) by smtp.gmail.com with ESMTPSA id g9sm2528080pfh.13.2021.09.29.05.41.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Sep 2021 05:41:15 -0700 (PDT) From: Sumit Saxena To: linux-scsi@vger.kernel.org, martin.petersen@oracle.com, jejb@linux.vnet.ibm.com Cc: chandrakanth.patil@broadcom.com, kashyap.desai@broadcom.com, Sumit Saxena Subject: [PATCH 1/3] megaraid_sas: fix concurrent access to ISR between IRQ polling and real interrupt Date: Wed, 29 Sep 2021 18:10:20 +0530 Message-Id: <20210929124022.24605-2-sumit.saxena@broadcom.com> X-Mailer: git-send-email 2.18.1 In-Reply-To: <20210929124022.24605-1-sumit.saxena@broadcom.com> References: <20210929124022.24605-1-sumit.saxena@broadcom.com> Precedence: bulk List-ID: X-Mailing-List: linux-scsi@vger.kernel.org IRQ polling thread calls ISR after enable_irq() to handle any missed IO completion. atomic flag "in_used" was added to have the synchronization between the IRQ polling thread and the interrupt context. There is a bug around it leading to a race condition. Below is the sequence: -IRQ polling thread accesses ISR, fetches the reply descriptor. -Real interrupt arrives and pre-empts polling thread(see enable_irq() is already called). -Interrupt context picks the same reply descriptor as fetched by polling thread, processes it, and exits. -Polling thread resumes and processes the descriptor which is already processed by interrupt thread leads to kernel crash. Setting the "in_used" flag before fetching the reply descriptor ensures synchronized access to ISR. Link: https://www.spinics.net/lists/linux-scsi/msg159440.html Signed-off-by: Sumit Saxena Fixes: 9bedd36e9146 (scsi: megaraid_sas: Handle missing interrupts while re-enabling IRQs) --- drivers/scsi/megaraid/megaraid_sas_fusion.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c index 26d0cf9353dd..eb5ceb75a15e 100644 --- a/drivers/scsi/megaraid/megaraid_sas_fusion.c +++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c @@ -3530,6 +3530,9 @@ complete_cmd_fusion(struct megasas_instance *instance, u32 MSIxIndex, if (atomic_read(&instance->adprecovery) == MEGASAS_HW_CRITICAL_ERROR) return IRQ_HANDLED; + if (irq_context && !atomic_add_unless(&irq_context->in_used, 1, 1)) + return 0; + desc = fusion->reply_frames_desc[MSIxIndex] + fusion->last_reply_idx[MSIxIndex]; @@ -3540,11 +3543,11 @@ complete_cmd_fusion(struct megasas_instance *instance, u32 MSIxIndex, reply_descript_type = reply_desc->ReplyFlags & MPI2_RPY_DESCRIPT_FLAGS_TYPE_MASK; - if (reply_descript_type == MPI2_RPY_DESCRIPT_FLAGS_UNUSED) + if (reply_descript_type == MPI2_RPY_DESCRIPT_FLAGS_UNUSED) { + if (irq_context) + atomic_dec(&irq_context->in_used); return IRQ_NONE; - - if (irq_context && !atomic_add_unless(&irq_context->in_used, 1, 1)) - return 0; + } num_completed = 0;