From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: "Pali Rohár" <pali.rohar@gmail.com>,
"Andrey Konovalov" <andreyknvl@google.com>,
"Hans de Goede" <hdegoede@redhat.com>,
"Mathias Gottschlag" <mgottschlag@gmail.com>,
"Shailendra Verma" <shailendra.capricorn@gmail.com>,
"Rusty Russell" <rusty@rustcorp.com.au>,
"Luis R. Rodriguez" <mcgrof@suse.com>,
"Thomas Hellstrom" <thellstrom@vmware.com>,
"linux-input@vger.kernel.org" <linux-input@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
"Kostya Serebryany" <kcc@google.com>,
"Alexander Potapenko" <glider@google.com>,
ktsan@googlegroups.com
Subject: Re: Potential data race in psmouse_interrupt
Date: Fri, 28 Aug 2015 10:51:47 -0700 [thread overview]
Message-ID: <CAKdAkRTtxBNstw+XkOVeY5RPqT8hOOOaA0==-nDiSjYYrV+xWQ@mail.gmail.com> (raw)
In-Reply-To: <CACT4Y+aG1zHHhfUmV_vMh-XsDLqwj3oSH54wobrf77=qyxVUhA@mail.gmail.com>
On Fri, Aug 28, 2015 at 10:34 AM, Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> I am looking at this code in __ps2_command again:
>
> /*
> * The reset command takes a long time to execute.
> */
> timeout = msecs_to_jiffies(command == PS2_CMD_RESET_BAT ? 4000 : 500);
>
> timeout = wait_event_timeout(ps2dev->wait,
> !(READ_ONCE(ps2dev->flags) & PS2_FLAG_CMD1), timeout);
>
> if (smp_load_acquire(&ps2dev->cmdcnt) &&
> !(smp_load_acquire(&ps2dev->flags) & PS2_FLAG_CMD1)) {
> timeout = ps2_adjust_timeout(ps2dev, command, timeout);
> wait_event_timeout(ps2dev->wait,
> !(smp_load_acquire(&ps2dev->flags) &
> PS2_FLAG_CMD), timeout);
> }
>
> if (param)
> for (i = 0; i < receive; i++)
> param[i] = ps2dev->cmdbuf[(receive - 1) - i];
>
>
> Here are two moments I don't understand:
> 1. The last parameter of ps2_adjust_timeout is timeout in jiffies (it
> is compared against 100ms). However, timeout is assigned to result of
> wait_event_timeout, which returns 0 or 1. This does not make sense to
> me. What am I missing?
The fact that wait_event_timeout can return value greater than one:
* Returns:
* 0 if the @condition evaluated to %false after the @timeout elapsed,
* 1 if the @condition evaluated to %true after the @timeout elapsed,
* or the remaining jiffies (at least 1) if the @condition evaluated
^^^^^^^^^^^^^^^^^^^^^^^^^
> 2. This code pays great attention to timeouts, but in the end I don't
> see how it handles timeouts. That is, if a timeout is happened, we
> still copyout (garbage) from cmdbuf. What am I missing here?
Once upon a time wait_event() did not return positive value when
timeout expired and then condition satisfied. So we just examine the
final state (psmpouse->cmdcnt should be 0 if command actually
succeeded) and even if we copy in garbage nobody should care since
we'll return error in this case.
Thanks.
--
Dmitry
next prev parent reply other threads:[~2015-08-28 17:51 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAAeHK+wZ=fXCRDUvkQdSmFWxU1fqN5suF=P1kL_CT1L8p3ybDg@mail.gmail.com>
2015-07-22 13:14 ` Fwd: Potential data race in psmouse_interrupt Andrey Konovalov
2015-07-22 16:52 ` Dmitry Torokhov
2015-07-23 13:08 ` Pali Rohár
2015-07-23 13:31 ` Andrey Konovalov
2015-07-29 11:53 ` Pali Rohár
2015-08-28 17:34 ` Dmitry Vyukov
2015-08-28 17:51 ` Dmitry Torokhov [this message]
2015-08-28 18:08 ` Dmitry Vyukov
2015-08-28 18:32 ` Dmitry Torokhov
2015-08-28 18:34 ` Dmitry Torokhov
2015-09-01 18:46 ` Dmitry Vyukov
2015-09-04 16:56 ` Dmitry Torokhov
2015-09-04 19:32 ` Dmitry Vyukov
2015-09-04 20:27 ` Dmitry Torokhov
2015-09-05 13:21 ` Dmitry Vyukov
2015-09-07 14:06 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKdAkRTtxBNstw+XkOVeY5RPqT8hOOOaA0==-nDiSjYYrV+xWQ@mail.gmail.com' \
--to=dmitry.torokhov@gmail.com \
--cc=andreyknvl@google.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=hdegoede@redhat.com \
--cc=kcc@google.com \
--cc=ktsan@googlegroups.com \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mcgrof@suse.com \
--cc=mgottschlag@gmail.com \
--cc=pali.rohar@gmail.com \
--cc=rusty@rustcorp.com.au \
--cc=shailendra.capricorn@gmail.com \
--cc=thellstrom@vmware.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).