public inbox for linux-crypto@vger.kernel.org
 help / color / mirror / Atom feed
From: Kun Song <Kun.Song@windriver.com>
To: <horia.geanta@nxp.com>, <aymen.sghaier@nxp.com>,
	<herbert@gondor.apana.org.au>, <davem@davemloft.net>
Cc: <linux-crypto@vger.kernel.org>, <filip.pudak@windriver.com>,
	<heng.guo@windriver.com>, <kun.song@windriver.com>
Subject: [PATCH v5.10.y] crypto: caam/jr - Fix possible caam_jr crash
Date: Thu, 21 Dec 2023 17:32:09 +0800	[thread overview]
Message-ID: <20231221093209.984929-1-Kun.Song@windriver.com> (raw)

Test environment:
  Linux kernel version: 5.10.y
  Architecture: ARM Cortex-A
  Processor: NXP Layerscape LS1028

Crash in reboot tests:
  Reproducibility: 1%

If a job ring is still allocated, Once caam_jr_remove() returned,
jrpriv will be freed and the registers will get unmapped.Then
caam_jr_interrupt will get error irqstate value.
So such a job ring will probably crash.Crash info is below:
--------------------------------------
RBS Sys: Restart ordered by epghd(0x1)
RBS Sys: RESTARTING
caam_jr 8030000.jr: Device is busy
caam_jr 8020000.jr: Device is busy
caam_jr 8010000.jr: Device is busy
arm-smmu 5000000.iommu: disabling translation
caam_jr 8010000.jr: job ring error: irqstate: 00000103
------------[ cut here ]------------
kernel BUG at drivers/crypto/caam/jr.c:288!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Hardware name: freescale ls1028a/ls1028a, BIOS 2019.10+fsl+g3d542a3d22
pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--)
pc : caam_jr_interrupt+0x128/0x130
lr : caam_jr_interrupt+0x128/0x130
sp : ffff80001144be50
x29: ffff80001144be50 x28: ffff800010f61008
x27: ffff800011228000 x26: ffff800010f61008
x25: ffff000027904800 x24: 0000000000000072
x23: ffff8000113ba140 x22: 0000000000000001
x21: ffff800011433000 x20: ffff000027904e80
x19: 0000000000000103 x18: 0000000000000030
x17: 0000000000000000 x16: 0000000000000000
x15: ffffffffffffffff x14: ffff8000113ebcb8
x13: 0000000000000008 x12: fffffffffffcac8f
x11: ffff00000038bb00 x10: ffff8000112a1e90
x9 : ffff8000100a99c0 x8 : ffff800011249e90
x7 : ffff8000112a1e90 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000
x3 : 0000000000000000 x2 : 0000000000000000
x1 : 0000000000000000 x0 : ffff0000279ac600
Call trace:
 caam_jr_interrupt+0x128/0x130
 __handle_irq_event_percpu+0x84/0x2b0
 handle_irq_event+0x6c/0xfc
 handle_fasteoi_irq+0xc8/0x230
 __handle_domain_irq+0xb8/0x130
 gic_handle_irq+0x90/0x158
 el1_irq+0xcc/0x180
 _raw_spin_lock_irq+0x0/0x90
 caam_rng_read_one.constprop.0+0x248/0x370
 caam_read+0x8c/0xb0
 hwrng_fillfn+0xfc/0x1cc
 kthread+0x14c/0x160
 ret_from_fork+0x10/0x30
Code: 2a1303e2 d00029a1 910ee021 940b2b1d (d4210000)
---[ end trace f04d90f3ad0da5f4 ]---
Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt
Kernel Offset: disabled
CPU features: 0x28040022,21002008
Memory Limit: none
--------------------------------------

Disabling interrupts is to ensure that the device removal
operation is not interrupted.

Signed-off-by: Kun Song <Kun.Song@windriver.com>
Reviewed-by: Hen Guo <Heng.Guo@windriver.com>
---
 drivers/crypto/caam/jr.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c
index 6f669966ba2c..d191e8caa1ad 100644
--- a/drivers/crypto/caam/jr.c
+++ b/drivers/crypto/caam/jr.c
@@ -135,6 +135,10 @@ static int caam_jr_remove(struct platform_device *pdev)
 	jrdev = &pdev->dev;
 	jrpriv = dev_get_drvdata(jrdev);
 
+	/* Disabling interrupts is ensure that the device removal operation
+	 * is not interrupted by interrupts.
+	 */
+	devm_free_irq(jrdev, jrpriv->irq, jrdev);
 	if (jrpriv->hwrng)
 		caam_rng_exit(jrdev->parent);
 
-- 
2.26.1


             reply	other threads:[~2023-12-21  9:32 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-12-21  9:32 Kun Song [this message]
2023-12-22 11:43 ` [PATCH v5.10.y] crypto: caam/jr - Fix possible caam_jr crash Gaurav Jain (OSS)
2023-12-25  3:05   ` Kun Song
2024-01-10  1:39   ` [REMINDER] " Kun Song
2024-01-10  6:57     ` Gaurav Jain (OSS)
2024-01-10  7:00     ` Gaurav Jain
2024-01-10  8:25       ` Kun Song
2024-01-10  9:14         ` [EXT] " Gaurav Jain
2024-01-10 11:56           ` Kun Song
2024-01-11 10:46             ` [EXT] " Gaurav Jain
2024-01-31 13:34 ` Horia Geanta

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20231221093209.984929-1-Kun.Song@windriver.com \
    --to=kun.song@windriver.com \
    --cc=aymen.sghaier@nxp.com \
    --cc=davem@davemloft.net \
    --cc=filip.pudak@windriver.com \
    --cc=heng.guo@windriver.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=horia.geanta@nxp.com \
    --cc=linux-crypto@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox