From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter Hurley Subject: Re: [PATCH 1/2] tty: serial: msm: Fix sysrq spinlock recursion on non-DM Date: Thu, 30 Oct 2014 09:29:00 -0400 Message-ID: <54523D1C.6080803@hurleysoftware.com> References: <1414606478-13709-1-git-send-email-sboyd@codeaurora.org> <1414606478-13709-2-git-send-email-sboyd@codeaurora.org> <5452204F.9090800@linaro.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Return-path: Received: from mailout32.mail01.mtsvc.net ([216.70.64.70]:38018 "EHLO n23.mail01.mtsvc.net" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1759695AbaJ3N3H (ORCPT ); Thu, 30 Oct 2014 09:29:07 -0400 In-Reply-To: <5452204F.9090800@linaro.org> Sender: linux-arm-msm-owner@vger.kernel.org List-Id: linux-arm-msm@vger.kernel.org To: Daniel Thompson , Stephen Boyd Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-serial@vger.kernel.org, Frank Rowand On 10/30/2014 07:26 AM, Daniel Thompson wrote: > On 29/10/14 18:14, Stephen Boyd wrote: >> The handle_rx() path calls uart_handle_sysrq_char() with the port >> lock held. This causes a spinlock recursion. Release and >> reacquire the lock here to avoid this. >> >> BUG: spinlock recursion on CPU#0, swapper/0 >> lock: msm_uart_ports+0x1e0/0x2d0, .magic: dead4ead, .owner: swapper/0, .owner_cpu: 0 >> CPU: 0 PID: 0 Comm: swapper Not tainted 3.17.0-rc7-00012-gb38ee8265941 #69 >> [] (unwind_backtrace) from [] (show_stack+0x10/0x14) >> [] (show_stack) from [] (do_raw_spin_lock+0x11c/0x13c) >> [] (do_raw_spin_lock) from [] (msm_console_write+0x78/0x188) >> [] (msm_console_write) from [] (call_console_drivers.constprop.22+0xb4/0x144) >> [] (call_console_drivers.constprop.22) from [] (console_unlock+0x27c/0x4ac) >> [] (console_unlock) from [] (vprintk_emit+0x1f4/0x5a8) >> [] (vprintk_emit) from [] (printk+0x30/0x40) >> [] (printk) from [] (__handle_sysrq+0x58/0x1b8) >> [] (__handle_sysrq) from [] (msm_irq+0x694/0x6f8) >> [] (msm_irq) from [] (handle_irq_event_percpu+0x58/0x270) >> [] (handle_irq_event_percpu) from [] (handle_irq_event+0x3c/0x5c) >> [] (handle_irq_event) from [] (handle_level_irq+0x9c/0x138) >> [] (handle_level_irq) from [] (generic_handle_irq+0x24/0x38) >> [] (generic_handle_irq) from [] (handle_IRQ+0x44/0xb0) >> [] (handle_IRQ) from [] (msm_vic_handle_irq+0x44/0x64) >> [] (msm_vic_handle_irq) from [] (__irq_svc+0x44/0x7c) >> Exception stack(0xc0719f68 to 0xc0719fb0) >> 9f60: 00000001 00000001 00000000 c0722938 c0718000 c0769acc >> 9f80: 00000000 c0720098 c0769305 4117b362 c0769acc 00000000 01000000 c0719fb0 >> 9fa0: c004cab0 c000f880 20000013 ffffffff >> [] (__irq_svc) from [] (arch_cpu_idle+0x20/0x30) >> [] (arch_cpu_idle) from [] (cpu_startup_entry+0xf4/0x23c) >> [] (cpu_startup_entry) from [] (start_kernel+0x32c/0x394) >> >> Cc: Frank Rowand >> Cc: Daniel Thompson >> Signed-off-by: Stephen Boyd >> --- >> drivers/tty/serial/msm_serial.c | 6 +++++- >> 1 file changed, 5 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c >> index 4b6c78331a64..cedcc36762a2 100644 >> --- a/drivers/tty/serial/msm_serial.c >> +++ b/drivers/tty/serial/msm_serial.c >> @@ -174,6 +174,7 @@ static void handle_rx(struct uart_port *port) >> while ((sr = msm_read(port, UART_SR)) & UART_SR_RX_READY) { >> unsigned int c; >> char flag = TTY_NORMAL; >> + int sysrq; >> >> c = msm_read(port, UART_RF); >> >> @@ -195,7 +196,10 @@ static void handle_rx(struct uart_port *port) >> else if (sr & UART_SR_PAR_FRAME_ERR) >> flag = TTY_FRAME; >> >> - if (!uart_handle_sysrq_char(port, c)) >> + spin_unlock(&port->lock); >> + sysrq = uart_handle_sysrq_char(port, c); >> + spin_lock(&port->lock); >> + if (!sysrq) >> tty_insert_flip_char(tport, c, flag); > > Does tty_insert_flip_char() need the port to be locked? No. It does not serialize internally, so concurrent use will blow up, but that doesn't look possible here. Can bad things happen if a well-timed set_termios() happens while the lock is dropped? Regards, Peter Hurley From mboxrd@z Thu Jan 1 00:00:00 1970 From: peter@hurleysoftware.com (Peter Hurley) Date: Thu, 30 Oct 2014 09:29:00 -0400 Subject: [PATCH 1/2] tty: serial: msm: Fix sysrq spinlock recursion on non-DM In-Reply-To: <5452204F.9090800@linaro.org> References: <1414606478-13709-1-git-send-email-sboyd@codeaurora.org> <1414606478-13709-2-git-send-email-sboyd@codeaurora.org> <5452204F.9090800@linaro.org> Message-ID: <54523D1C.6080803@hurleysoftware.com> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On 10/30/2014 07:26 AM, Daniel Thompson wrote: > On 29/10/14 18:14, Stephen Boyd wrote: >> The handle_rx() path calls uart_handle_sysrq_char() with the port >> lock held. This causes a spinlock recursion. Release and >> reacquire the lock here to avoid this. >> >> BUG: spinlock recursion on CPU#0, swapper/0 >> lock: msm_uart_ports+0x1e0/0x2d0, .magic: dead4ead, .owner: swapper/0, .owner_cpu: 0 >> CPU: 0 PID: 0 Comm: swapper Not tainted 3.17.0-rc7-00012-gb38ee8265941 #69 >> [] (unwind_backtrace) from [] (show_stack+0x10/0x14) >> [] (show_stack) from [] (do_raw_spin_lock+0x11c/0x13c) >> [] (do_raw_spin_lock) from [] (msm_console_write+0x78/0x188) >> [] (msm_console_write) from [] (call_console_drivers.constprop.22+0xb4/0x144) >> [] (call_console_drivers.constprop.22) from [] (console_unlock+0x27c/0x4ac) >> [] (console_unlock) from [] (vprintk_emit+0x1f4/0x5a8) >> [] (vprintk_emit) from [] (printk+0x30/0x40) >> [] (printk) from [] (__handle_sysrq+0x58/0x1b8) >> [] (__handle_sysrq) from [] (msm_irq+0x694/0x6f8) >> [] (msm_irq) from [] (handle_irq_event_percpu+0x58/0x270) >> [] (handle_irq_event_percpu) from [] (handle_irq_event+0x3c/0x5c) >> [] (handle_irq_event) from [] (handle_level_irq+0x9c/0x138) >> [] (handle_level_irq) from [] (generic_handle_irq+0x24/0x38) >> [] (generic_handle_irq) from [] (handle_IRQ+0x44/0xb0) >> [] (handle_IRQ) from [] (msm_vic_handle_irq+0x44/0x64) >> [] (msm_vic_handle_irq) from [] (__irq_svc+0x44/0x7c) >> Exception stack(0xc0719f68 to 0xc0719fb0) >> 9f60: 00000001 00000001 00000000 c0722938 c0718000 c0769acc >> 9f80: 00000000 c0720098 c0769305 4117b362 c0769acc 00000000 01000000 c0719fb0 >> 9fa0: c004cab0 c000f880 20000013 ffffffff >> [] (__irq_svc) from [] (arch_cpu_idle+0x20/0x30) >> [] (arch_cpu_idle) from [] (cpu_startup_entry+0xf4/0x23c) >> [] (cpu_startup_entry) from [] (start_kernel+0x32c/0x394) >> >> Cc: Frank Rowand >> Cc: Daniel Thompson >> Signed-off-by: Stephen Boyd >> --- >> drivers/tty/serial/msm_serial.c | 6 +++++- >> 1 file changed, 5 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c >> index 4b6c78331a64..cedcc36762a2 100644 >> --- a/drivers/tty/serial/msm_serial.c >> +++ b/drivers/tty/serial/msm_serial.c >> @@ -174,6 +174,7 @@ static void handle_rx(struct uart_port *port) >> while ((sr = msm_read(port, UART_SR)) & UART_SR_RX_READY) { >> unsigned int c; >> char flag = TTY_NORMAL; >> + int sysrq; >> >> c = msm_read(port, UART_RF); >> >> @@ -195,7 +196,10 @@ static void handle_rx(struct uart_port *port) >> else if (sr & UART_SR_PAR_FRAME_ERR) >> flag = TTY_FRAME; >> >> - if (!uart_handle_sysrq_char(port, c)) >> + spin_unlock(&port->lock); >> + sysrq = uart_handle_sysrq_char(port, c); >> + spin_lock(&port->lock); >> + if (!sysrq) >> tty_insert_flip_char(tport, c, flag); > > Does tty_insert_flip_char() need the port to be locked? No. It does not serialize internally, so concurrent use will blow up, but that doesn't look possible here. Can bad things happen if a well-timed set_termios() happens while the lock is dropped? Regards, Peter Hurley