Re: [PATCH] net: qrtr: mhi: synchronize qrtr and mhi preparation

[Johan Hovold <johan@kernel.org>]

Hi Chris,

On Thu, Nov 21, 2024 at 04:28:41PM -0800, Chris Lew wrote:
> On 11/8/2024 2:32 AM, Johan Hovold wrote:
> > On Mon, Nov 04, 2024 at 05:29:37PM -0800, Chris Lew wrote:
> >> From: Bhaumik Bhatt <bbhatt@codeaurora.org>
> >>
> >> The call to qrtr_endpoint_register() was moved before
> >> mhi_prepare_for_transfer_autoqueue() to prevent a case where a dl
> >> callback can occur before the qrtr endpoint is registered.
> >>
> >> Now the reverse can happen where qrtr will try to send a packet
> >> before the channels are prepared. Add a wait in the sending path to
> >> ensure the channels are prepared before trying to do a ul transfer.
> >>
> >> Fixes: 68a838b84eff ("net: qrtr: start MHI channel after endpoit creation")
> >> Reported-by: Johan Hovold <johan@kernel.org>
> >> Closes: https://lore.kernel.org/linux-arm-msm/ZyTtVdkCCES0lkl4@hovoldconsulting.com/
> >> Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
> >> Signed-off-by: Chris Lew <quic_clew@quicinc.com>
> > 
> >> @@ -53,6 +54,10 @@ static int qcom_mhi_qrtr_send(struct qrtr_endpoint *ep, struct sk_buff *skb)
> >>   	if (skb->sk)
> >>   		sock_hold(skb->sk);
> >>   
> >> +	rc = wait_for_completion_interruptible(&qdev->prepared);
> >> +	if (rc)
> >> +		goto free_skb;
> >> +
> >>   	rc = skb_linearize(skb);
> >>   	if (rc)
> >>   		goto free_skb;
> >> @@ -85,6 +90,7 @@ static int qcom_mhi_qrtr_probe(struct mhi_device *mhi_dev,
> >>   	qdev->mhi_dev = mhi_dev;
> >>   	qdev->dev = &mhi_dev->dev;
> >>   	qdev->ep.xmit = qcom_mhi_qrtr_send;
> >> +	init_completion(&qdev->prepared);
> >>   
> >>   	dev_set_drvdata(&mhi_dev->dev, qdev);
> >>   	rc = qrtr_endpoint_register(&qdev->ep, QRTR_EP_NID_AUTO);
> >> @@ -97,6 +103,7 @@ static int qcom_mhi_qrtr_probe(struct mhi_device *mhi_dev,
> >>   		qrtr_endpoint_unregister(&qdev->ep);
> >>   		return rc;
> >>   	}
> >> +	complete_all(&qdev->prepared);
> >>   
> >>   	dev_dbg(qdev->dev, "Qualcomm MHI QRTR driver probed\n");
> > 
> > While this probably works, it still looks like a bit of a hack.
> > 
> > Why can't you restructure the code so that the channels are fully
> > initialised before you register or enable them instead?
> 
> Ok, I think we will have to stop using the autoqueue feature of MHI and 
> change the flow to be mhi_prepare_for_transfer() --> 
> qrtr_endpoint_register() --> mhi_queue_buf(DMA_FROM_DEVICE). This would 
> make it so ul_transfers only happen after mhi_prepare_for_transfer() and 
> dl_transfers happen after qrtr_endpoint_register().
> 
> I'll take a stab at implementing this.

This bug still exists in mainline and occasionally triggers a
NULL-pointer dereference on boot with the in-kernel pd-mapper on X Elite
laptops like the T14s.

Have you made any progress in reworking the code to address the race?

Johan