[PATCH] mtd: rawnand: r852: prevent card work from being requeued during shutdown

[PATCH] mtd: rawnand: r852: prevent card work from being requeued during shutdown

[James Hilliard]

The card interrupt can queue card_detect_work after shutdown cancels it
but before interrupts are disabled. The worker can then access the
controller after pci_disable_device(), and can enable card interrupts
again while processing the event.

Disable and drain the delayed work before turning off interrupts and the
PCI device. Later queue attempts are rejected while the IRQ handler can
still acknowledge events until interrupt teardown completes.

Fixes: 67e054e91924 ("mtd: nand: Add driver for Ricoh xD/SmartMedia reader")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
 drivers/mtd/nand/raw/r852.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/r852.c b/drivers/mtd/nand/raw/r852.c
index 92c47d351c27..bf1c1be7f2aa 100644
--- a/drivers/mtd/nand/raw/r852.c
+++ b/drivers/mtd/nand/raw/r852.c
@@ -1007,7 +1007,7 @@ static void r852_shutdown(struct pci_dev *pci_dev)
 {
 	struct r852_device *dev = pci_get_drvdata(pci_dev);
 
-	cancel_delayed_work_sync(&dev->card_detect_work);
+	disable_delayed_work_sync(&dev->card_detect_work);
 	r852_disable_irqs(dev);
 	synchronize_irq(dev->irq);
 	pci_disable_device(pci_dev);

---
base-commit: 30daaf3e7897b4a8d9b72e5b0c86dd6e2a4d7d85
change-id: 20261107-submit-r852-shutdown-work-v1-15fe04537064

Best regards,
--  
James Hilliard <james.hilliard1@gmail.com>


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH] mtd: rawnand: r852: prevent card work from being requeued during shutdown

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] mtd: rawnand: r852: unprotected register access in
  r852_update_card_detect() [1]
--

commit 9d313af3cdbf139593a845ec29f559aa0df5bf6b
Author: James Hilliard <james.hilliard1@gmail.com>

mtd: rawnand: r852: prevent card work from being requeued during shutdown

This commit replaces cancel_delayed_work_sync() with
disable_delayed_work_sync() in r852_shutdown() so card_detect_work cannot
be requeued before interrupts are disabled.

> diff --git a/drivers/mtd/nand/raw/r852.c b/drivers/mtd/nand/raw/r852.c
> index 92c47d351c278..bf1c1be7f2aa7 100644
> --- a/drivers/mtd/nand/raw/r852.c
> +++ b/drivers/mtd/nand/raw/r852.c
> @@ -1007,7 +1007,7 @@ static void r852_shutdown(struct pci_dev *pci_dev)
>  {
>  	struct r852_device *dev = pci_get_drvdata(pci_dev);
>  
> -	cancel_delayed_work_sync(&dev->card_detect_work);
> +	disable_delayed_work_sync(&dev->card_detect_work);
>  	r852_disable_irqs(dev);

[Severity: High]
This problem wasn't introduced by this patch, but can
r852_update_card_detect() [1] race with r852_irq() on
R852_CARD_IRQ_ENABLE and unmask disabled interrupts?

drivers/mtd/nand/raw/r852.c:r852_update_card_detect() {
	int card_detect_reg = r852_read_reg(dev, R852_CARD_IRQ_ENABLE);
	...
	r852_write_reg(dev, R852_CARD_IRQ_ENABLE, card_detect_reg);
}

card_detect_work calls r852_update_card_detect(), which performs this
read-modify-write without holding dev->irqlock:

CPU0 (kworker)                    CPU1 (<hardirq>)
r852_card_detect_work()
  r852_update_card_detect()
    reg = r852_read_reg(...)
                                  r852_irq()
                                    spin_lock_irqsave(&dev->irqlock)
                                    r852_disable_irqs()
                                      r852_write_reg(...)
                                    spin_unlock_irqrestore(&dev->irqlock)
    r852_write_reg(..., reg)  <-- overwrites masked IRQs

When the worker writes back its stale value, it re-enables interrupts
that r852_irq() just masked, which can trigger an IRQ storm.

[1] https://sashiko.dev/#/bug/linux-c0fe7604-3210-4aa5-9a00-b60066cbe1db

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-submit-r852-shutdown-work-v1-v1-1-8e448ad7c54c@gmail.com?part=1

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/