From mboxrd@z Thu Jan 1 00:00:00 1970 From: Uwe =?iso-8859-1?Q?Kleine-K=F6nig?= Subject: Re: [PATCH] net: dsa: mv88e6xxx: fix races between lock and irq freeing Date: Sun, 22 Jul 2018 22:38:26 +0200 Message-ID: <20180722203826.ffksnbc6w3anhzy5@pengutronix.de> References: <20180720095315.21055-1-u.kleine-koenig@pengutronix.de> <20180721.224409.437815752648454744.davem@davemloft.net> <20180722190035.ehav25wwwtz3fxfm@pengutronix.de> <20180722.130411.1782941097108136413.davem@davemloft.net> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Cc: andrew@lunn.ch, vivien.didelot@savoirfairelinux.com, f.fainelli@gmail.com, netdev@vger.kernel.org, kernel@pengutronix.de To: David Miller Return-path: Received: from metis.ext.pengutronix.de ([85.220.165.71]:59911 "EHLO metis.ext.pengutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729890AbeGVVg1 (ORCPT ); Sun, 22 Jul 2018 17:36:27 -0400 Content-Disposition: inline In-Reply-To: <20180722.130411.1782941097108136413.davem@davemloft.net> Sender: netdev-owner@vger.kernel.org List-ID: On Sun, Jul 22, 2018 at 01:04:11PM -0700, David Miller wrote: > From: Uwe Kleine-König > Date: Sun, 22 Jul 2018 21:00:35 +0200 > > > On Sat, Jul 21, 2018 at 10:44:09PM -0700, David Miller wrote: > >> From: Uwe Kleine-König > >> Date: Fri, 20 Jul 2018 11:53:15 +0200 > >> > >> > free_irq() waits until all handlers for this IRQ have completed. As the > >> > relevant handler (mv88e6xxx_g1_irq_thread_fn()) takes the chip's reg_lock > >> > it might never return if the thread calling free_irq() holds this lock. > >> > > >> > For the same reason kthread_cancel_delayed_work_sync() in the polling case > >> > must not hold this lock. > >> > > >> > Also first free the irq (or stop the worker respectively) such that > >> > mv88e6xxx_g1_irq_thread_work() isn't called any more before the irq > >> > mappings are dropped in mv88e6xxx_g1_irq_free_common() to prevent the > >> > worker thread to call handle_nested_irq(0) which results in a NULL-pointer > >> > exception. > >> > > >> > Signed-off-by: Uwe Kleine-König > >> > >> Looks good. > >> > >> Note than the IRQ domain unmapping will do a synchronize_irq() which > >> should cause the same deadlock as free_irq() will with the reg_lock > >> held. > > > > Do you think that there is still a problem? When free_irq() for the > > external visible irq returns the muxed irqs should be all gone, too, so > > this should not trigger, should it? > > It shouldn't be a problem after your changes. > > I'm just saying that I'm surprised that, in the original code, you see > the deadlock in free_irq(), since the synchronize_irq() done by the > IRQ domain code should have happened first. ah, I see. This didn't happen because I added an msleep to mv88e6xxx_g1_irq_thread_work() before the lock it taken to widen the race window for a different problem. So the sub-irqs were not active when mv88e6xxx_g1_irq_free() run, only the mux-irq was. When irq_dispose_mapping() is called for the sub-irq there is no problem as this results in synchronize_irq() for the sub-irq, not the mux-irq. Best regards Uwe -- Pengutronix e.K. | Uwe Kleine-König | Industrial Linux Solutions | http://www.pengutronix.de/ |