From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: farah kassabri <fkassabri@habana.ai>,
Oded Gabbay <ogabbay@kernel.org>, Sasha Levin <sashal@kernel.org>,
gregkh@linuxfoundation.org, ttayar@habana.ai,
ynudelman@habana.ai, talcohen@habana.ai
Subject: [PATCH AUTOSEL 6.2 31/60] habanalabs: fix bug in timestamps registration code
Date: Sun, 26 Feb 2023 21:00:16 -0500 [thread overview]
Message-ID: <20230227020045.1045105-31-sashal@kernel.org> (raw)
In-Reply-To: <20230227020045.1045105-1-sashal@kernel.org>
From: farah kassabri <fkassabri@habana.ai>
[ Upstream commit ac5af9900f82b7034de7c9eb1d70d030ba325607 ]
Protect re-using the same timestamp buffer record before actually
adding it to the to interrupt wait list.
Mark ts buff offset as in use in the spinlock protection area of the
interrupt wait list to avoid getting in the re-use section in
ts_buff_get_kernel_ts_record before adding the node to the list.
this scenario might happen when multiple threads are racing on
same offset and one thread could set data in the ts buff in
ts_buff_get_kernel_ts_record then the other thread takes over
and get to ts_buff_get_kernel_ts_record and we will try
to re-use the same ts buff offset then we will try to
delete a non existing node from the list.
Signed-off-by: farah kassabri <fkassabri@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../habanalabs/common/command_submission.c | 33 ++++++++++++-------
1 file changed, 22 insertions(+), 11 deletions(-)
diff --git a/drivers/misc/habanalabs/common/command_submission.c b/drivers/misc/habanalabs/common/command_submission.c
index ea0e5101c10ed..6367cbea4ca2a 100644
--- a/drivers/misc/habanalabs/common/command_submission.c
+++ b/drivers/misc/habanalabs/common/command_submission.c
@@ -3119,19 +3119,18 @@ static int ts_buff_get_kernel_ts_record(struct hl_mmap_mem_buf *buf,
goto start_over;
}
} else {
+ /* Fill up the new registration node info */
+ requested_offset_record->ts_reg_info.buf = buf;
+ requested_offset_record->ts_reg_info.cq_cb = cq_cb;
+ requested_offset_record->ts_reg_info.timestamp_kernel_addr =
+ (u64 *) ts_buff->user_buff_address + ts_offset;
+ requested_offset_record->cq_kernel_addr =
+ (u64 *) cq_cb->kernel_address + cq_offset;
+ requested_offset_record->cq_target_value = target_value;
+
spin_unlock_irqrestore(wait_list_lock, flags);
}
- /* Fill up the new registration node info */
- requested_offset_record->ts_reg_info.in_use = 1;
- requested_offset_record->ts_reg_info.buf = buf;
- requested_offset_record->ts_reg_info.cq_cb = cq_cb;
- requested_offset_record->ts_reg_info.timestamp_kernel_addr =
- (u64 *) ts_buff->user_buff_address + ts_offset;
- requested_offset_record->cq_kernel_addr =
- (u64 *) cq_cb->kernel_address + cq_offset;
- requested_offset_record->cq_target_value = target_value;
-
*pend = requested_offset_record;
dev_dbg(buf->mmg->dev, "Found available node in TS kernel CB %p\n",
@@ -3179,7 +3178,7 @@ static int _hl_interrupt_wait_ioctl(struct hl_device *hdev, struct hl_ctx *ctx,
goto put_cq_cb;
}
- /* Find first available record */
+ /* get ts buffer record */
rc = ts_buff_get_kernel_ts_record(buf, cq_cb, ts_offset,
cq_counters_offset, target_value,
&interrupt->wait_list_lock, &pend);
@@ -3227,7 +3226,19 @@ static int _hl_interrupt_wait_ioctl(struct hl_device *hdev, struct hl_ctx *ctx,
* Note that we cannot have sorted list by target value,
* in order to shorten the list pass loop, since
* same list could have nodes for different cq counter handle.
+ * Note:
+ * Mark ts buff offset as in use here in the spinlock protection area
+ * to avoid getting in the re-use section in ts_buff_get_kernel_ts_record
+ * before adding the node to the list. this scenario might happen when
+ * multiple threads are racing on same offset and one thread could
+ * set the ts buff in ts_buff_get_kernel_ts_record then the other thread
+ * takes over and get to ts_buff_get_kernel_ts_record and then we will try
+ * to re-use the same ts buff offset, and will try to delete a non existing
+ * node from the list.
*/
+ if (register_ts_record)
+ pend->ts_reg_info.in_use = 1;
+
list_add_tail(&pend->wait_list_node, &interrupt->wait_list_head);
spin_unlock_irqrestore(&interrupt->wait_list_lock, flags);
--
2.39.0
next prev parent reply other threads:[~2023-02-27 2:03 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-27 1:59 [PATCH AUTOSEL 6.2 01/60] drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Tab 3 X90F Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 02/60] drm: panel-orientation-quirks: Add quirk for DynaBook K50 Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 03/60] drm/amd/display: Reduce expected sdp bandwidth for dcn321 Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 04/60] drm/amd/display: Revert Reduce delay when sink device not able to ACK 00340h write Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 05/60] drm/amd/display: Fix potential null-deref in dm_resume Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 06/60] drm/omap: dsi: Fix excessive stack usage Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 07/60] HID: Add Mapping for System Microphone Mute Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 08/60] drm/tiny: ili9486: Do not assume 8-bit only SPI controllers Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 09/60] drm/amd/display: Defer DIG FIFO disable after VID stream enable Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 10/60] drm/radeon: free iio for atombios when driver shutdown Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 11/60] drm/amd: Avoid BUG() for case of SRIOV missing IP version Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 12/60] drm/amdkfd: Page aligned memory reserve size Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 13/60] scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write Sasha Levin
2023-02-27 1:59 ` [PATCH AUTOSEL 6.2 14/60] Revert "fbcon: don't lose the console font across generic->chip driver switch" Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 15/60] drm/amd: Avoid ASSERT for some message failures Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 16/60] drm: amd: display: Fix memory leakage Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 17/60] drm/amd/display: fix mapping to non-allocated address Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 18/60] drm/msm/dp: Remove INIT_SETUP delay Sasha Levin
2023-02-27 9:12 ` Johan Hovold
2023-03-01 14:15 ` Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 19/60] HID: uclogic: Add frame type quirk Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 20/60] HID: uclogic: Add battery quirk Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 21/60] HID: uclogic: Add support for XP-PEN Deco Pro SW Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 22/60] HID: uclogic: Add support for XP-PEN Deco Pro MW Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 23/60] HID: multitouch: Add quirks for flipped axes Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 24/60] drm/msm/dsi: Add missing check for alloc_ordered_workqueue Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 25/60] drm: rcar-du: Add quirk for H3 ES1.x pclk workaround Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 26/60] drm: rcar-du: Fix setting a reserved bit in DPLLCR Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 27/60] drm/drm_print: correct format problem Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 28/60] drm/amd/display: Set hvm_enabled flag for S/G mode Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 29/60] drm/client: Test for connectors before sending hotplug event Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 30/60] habanalabs: extend fatal messages to contain PCI info Sasha Levin
2023-02-27 2:00 ` Sasha Levin [this message]
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 32/60] docs/scripts/gdb: add necessary make scripts_gdb step Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 33/60] drm/msm/dpu: Add DSC hardware blocks to register snapshot Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 34/60] ASoC: soc-compress: Reposition and add pcm_mutex Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 35/60] ASoC: kirkwood: Iterate over array indexes instead of using pointer math Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 36/60] regulator: max77802: Bounds check regulator id against opmode Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 37/60] regulator: s5m8767: Bounds check id indexing into arrays Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 38/60] Revert "drm/amdgpu: TA unload messages are not actually sent to psp when amdgpu is uninstalled" Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 39/60] drm/amd/display: fix FCLK pstate change underflow Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 40/60] gfs2: Improve gfs2_make_fs_rw error handling Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 41/60] hwmon: (coretemp) Simplify platform device handling Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 42/60] hwmon: (nct6775) Directly call ASUS ACPI WMI method Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 43/60] hwmon: (nct6775) B650/B660/X670 ASUS boards support Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 44/60] pinctrl: at91: use devm_kasprintf() to avoid potential leaks Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 45/60] drm/amd/display: Do not set DRR on pipe commit Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 46/60] drm/amd/display: Do not commit pipe when updating DRR Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 47/60] scsi: snic: Fix memory leak with using debugfs_lookup() Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 48/60] scsi: ufs: core: Fix device management cmd timeout flow Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 49/60] HID: logitech-hidpp: Don't restart communication if not necessary Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 50/60] drm/amd/display: Move DCN314 DOMAIN power control to DMCUB Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 51/60] drm/amd/display: Enable P-state validation checks for DCN314 Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 52/60] drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 53/60] drm/amd/display: Disable HUBP/DPP PG on DCN314 for now Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 54/60] drm/amd/display: disable SubVP + DRR to prevent underflow Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 55/60] dm thin: add cond_resched() to various workqueue loops Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 56/60] dm cache: " Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 57/60] nfsd: zero out pointers after putting nfsd_files on COPY setup error Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 58/60] nfsd: clean up potential nfsd_file refcount leaks in COPY codepath Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 59/60] nfsd: don't hand out delegation on setuid files being opened for write Sasha Levin
2023-02-27 2:00 ` [PATCH AUTOSEL 6.2 60/60] cifs: prevent data race in smb2_reconnect() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230227020045.1045105-31-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=fkassabri@habana.ai \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ogabbay@kernel.org \
--cc=stable@vger.kernel.org \
--cc=talcohen@habana.ai \
--cc=ttayar@habana.ai \
--cc=ynudelman@habana.ai \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).