Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1252227
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.13.y-ckt 82/85] mmc: core: fix race condition in mmc_wait_data_done |
| Date | 2015-10-21 00:30 +0200 |
| Message-ID | <qlNzR-pi-23@gated-at.bofh.it> (permalink) |
| References | <qlMNr-7E9-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.13.11-ckt28 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jialing Fu <jlfu@marvell.com>
commit 71f8a4b81d040b3d094424197ca2f1bf811b1245 upstream.
The following panic is captured in ker3.14, but the issue still exists
in latest kernel.
---------------------------------------------------------------------
[ 20.738217] c0 3136 (Compiler) Unable to handle kernel NULL pointer dereference
at virtual address 00000578
......
[ 20.738499] c0 3136 (Compiler) PC is at _raw_spin_lock_irqsave+0x24/0x60
[ 20.738527] c0 3136 (Compiler) LR is at _raw_spin_lock_irqsave+0x20/0x60
[ 20.740134] c0 3136 (Compiler) Call trace:
[ 20.740165] c0 3136 (Compiler) [<ffffffc0008ee900>] _raw_spin_lock_irqsave+0x24/0x60
[ 20.740200] c0 3136 (Compiler) [<ffffffc0000dd024>] __wake_up+0x1c/0x54
[ 20.740230] c0 3136 (Compiler) [<ffffffc000639414>] mmc_wait_data_done+0x28/0x34
[ 20.740262] c0 3136 (Compiler) [<ffffffc0006391a0>] mmc_request_done+0xa4/0x220
[ 20.740314] c0 3136 (Compiler) [<ffffffc000656894>] sdhci_tasklet_finish+0xac/0x264
[ 20.740352] c0 3136 (Compiler) [<ffffffc0000a2b58>] tasklet_action+0xa0/0x158
[ 20.740382] c0 3136 (Compiler) [<ffffffc0000a2078>] __do_softirq+0x10c/0x2e4
[ 20.740411] c0 3136 (Compiler) [<ffffffc0000a24bc>] irq_exit+0x8c/0xc0
[ 20.740439] c0 3136 (Compiler) [<ffffffc00008489c>] handle_IRQ+0x48/0xac
[ 20.740469] c0 3136 (Compiler) [<ffffffc000081428>] gic_handle_irq+0x38/0x7c
----------------------------------------------------------------------
Because in SMP, "mrq" has race condition between below two paths:
path1: CPU0: <tasklet context>
static void mmc_wait_data_done(struct mmc_request *mrq)
{
mrq->host->context_info.is_done_rcv = true;
//
// If CPU0 has just finished "is_done_rcv = true" in path1, and at
// this moment, IRQ or ICache line missing happens in CPU0.
// What happens in CPU1 (path2)?
//
// If the mmcqd thread in CPU1(path2) hasn't entered to sleep mode:
// path2 would have chance to break from wait_event_interruptible
// in mmc_wait_for_data_req_done and continue to run for next
// mmc_request (mmc_blk_rw_rq_prep).
//
// Within mmc_blk_rq_prep, mrq is cleared to 0.
// If below line still gets host from "mrq" as the result of
// compiler, the panic happens as we traced.
wake_up_interruptible(&mrq->host->context_info.wait);
}
path2: CPU1: <The mmcqd thread runs mmc_queue_thread>
static int mmc_wait_for_data_req_done(...
{
...
while (1) {
wait_event_interruptible(context_info->wait,
(context_info->is_done_rcv ||
context_info->is_new_req));
static void mmc_blk_rw_rq_prep(...
{
...
memset(brq, 0, sizeof(struct mmc_blk_request));
This issue happens very coincidentally; however adding mdelay(1) in
mmc_wait_data_done as below could duplicate it easily.
static void mmc_wait_data_done(struct mmc_request *mrq)
{
mrq->host->context_info.is_done_rcv = true;
+ mdelay(1);
wake_up_interruptible(&mrq->host->context_info.wait);
}
At runtime, IRQ or ICache line missing may just happen at the same place
of the mdelay(1).
This patch gets the mmc_context_info at the beginning of function, it can
avoid this race condition.
Signed-off-by: Jialing Fu <jlfu@marvell.com>
Tested-by: Shawn Lin <shawn.lin@rock-chips.com>
Fixes: 2220eedfd7ae ("mmc: fix async request mechanism ....")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/mmc/core/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 666d8c7..033d03c 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -329,8 +329,10 @@ EXPORT_SYMBOL(mmc_start_bkops);
*/
static void mmc_wait_data_done(struct mmc_request *mrq)
{
- mrq->host->context_info.is_done_rcv = true;
- wake_up_interruptible(&mrq->host->context_info.wait);
+ struct mmc_context_info *context_info = &mrq->host->context_info;
+
+ context_info->is_done_rcv = true;
+ wake_up_interruptible(&context_info->wait);
}
static void mmc_wait_done(struct mmc_request *mrq)
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.13.y-ckt stable] Linux 3.13.11-ckt28 stable review Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:40 +0200
[PATCH 3.13.y-ckt 73/85] perf hists: Update the column width for the "srcline" sort key Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 84/85] task_work: remove fifo ordering guarantee Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 65/85] drm/qxl: validate monitors config modes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 85/85] scsi_dh: fix randconfig build error Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 82/85] mmc: core: fix race condition in mmc_wait_data_done Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 81/85] IB/uverbs: Fix race between ib_uverbs_open and remove_one Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 79/85] IB/mlx4: Forbid using sysfs to change RoCE pkeys Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 80/85] IB/mlx4: Use correct SL on AH query under RoCE Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 83/85] ipv6: fix exthdrs offload registration in out_rt path Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 77/85] perf stat: Get correct cpu id for print_aggr Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 67/85] x86/mm: Initialize pmd_idx in page_table_range_init_count() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 55/85] Input: evdev - do not report errors form flush() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 48/85] xfs: return errors from partial I/O failures to files Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 75/85] batman-adv: Make NC capability changes atomic Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 69/85] jbd2: avoid infinite loop when destroying aborted journal Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 56/85] crypto: ghash-clmulni: specify context size for ghash async algorithm Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 50/85] tg3: Fix temperature reporting Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 60/85] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 49/85] IB/qib: Change lkey table allocation to support more MRs Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 70/85] clk: versatile: off by one in clk_sp810_timerclken_of_get() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 74/85] batman-adv: Make DAT capability changes atomic Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 41/85] Btrfs: check if previous transaction aborted to avoid fs corruption Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 71/85] usb: gadget: m66592-udc: forever loop in set_feature() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 78/85] IB/mlx4: Fix potential deadlock when sending mad to wire Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 57/85] fs: create and use seq_show_option for escaping Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 58/85] ALSA: hda - Enable headphone jack detect on old Fujitsu laptops Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 53/85] IB/uverbs: reject invalid or unknown opcodes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 61/85] parisc: Use double word condition in 64bit CAS operation Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 76/85] powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 51/85] drm/i915: Always mark the object as dirty when used by the GPU Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 54/85] hpfs: update ctime and mtime on directory modification Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 46/85] drivercore: Fix unregistration path of platform devices Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 68/85] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 47/85] Input: synaptics - fix handling of disabling gesture mode Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
Re: [PATCH 3.13.y-ckt 47/85] Input: synaptics - fix handling of disabling gesture mode Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2015-10-21 00:50 +0200
Re: [PATCH 3.13.y-ckt 47/85] Input: synaptics - fix handling of disabling gesture mode Kamal Mostafa <kamal@canonical.com> - 2015-10-21 22:30 +0200
[PATCH 3.13.y-ckt 43/85] rtlwifi: rtl8192cu: Add new device ID Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 21/85] iio: event: Remove negative error code from iio_event_poll Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 72/85] windfarm: decrement client count when unregistering Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 22/85] NFSv4: don't set SETATTR for O_RDONLY|O_EXCL Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 52/85] Add radeon suspend/resume quirk for HP Compaq dc5750. Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 59/85] ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 35/85] USB: ftdi_sio: Added custom PID for CustomWare products Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 30/85] xtensa: fix kernel register spilling Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 26/85] drivers: usb: fsl: Workaround for USB erratum-A005275 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 36/85] HID: usbhid: Fix the check for HID_RESET_PENDING in hid_io_error Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 17/85] iio: adis16400: Fix adis16448 gyroscope scale Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 38/85] libxfs: readahead of dir3 data blocks should use the read verifier Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 18/85] iio: Add inverse unit conversion macros Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 37/85] eCryptfs: Invalidate dcache entries when lower i_nlink is zero Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 31/85] NFS: nfs_set_pgio_error sometimes misses errors Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 44/85] rtlwifi: rtl8192cu: Add new device ID Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 45/85] of/address: Don't loop forever in of_find_matching_node_by_address(). Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 28/85] staging: comedi: adl_pci7x3x: fix digital output on PCI-7230 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 39/85] xfs: Fix xfs_attr_leafblock definition Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 27/85] serial: 8250: don't bind to SMSC IrCC IR port Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 34/85] USB: symbolserial: Use usb_get_serial_port_data Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 32/85] NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 client Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 29/85] blk-mq: fix buffer overflow when reading sysfs file of 'pending' Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 42/85] DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 33/85] usb: host: ehci-sys: delete useless bus_to_hcd conversion Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 40/85] arm64: kconfig: Move LIST_POISON to a safe value Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 02/85] dcache: Handle escaped paths in prepend_path Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 07/85] xtensa: fix threadptr reload on return to userspace Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 03/85] vfs: Test for and handle paths that are unreachable from their mnt_root Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 05/85] [media] v4l: omap3isp: Fix sub-device power management code Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 16/85] devres: fix devres_get() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 08/85] ARM: OMAP2+: DRA7: clockdomain: change l4per2_7xx_clkdm to SW_WKUP Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 04/85] sctp: fix race on protocol/netns initialization Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 12/85] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 14/85] KVM: MMU: fix validation of mmio page fault Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 11/85] PCI: Add VPD function 0 quirk for Intel Ethernet devices Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 10/85] PCI: Add dev_flags bit to access VPD through function 0 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 15/85] auxdisplay: ks0108: fix refcount Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 09/85] mac80211: enable assoc check for mesh interfaces Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 13/85] serial: 8250_pci: Add support for Pericom PI7C9X795[1248] Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
csiph-web