linux-kernel - Re: [PATCH 08/11] In the uart_handle_cts_change(), uart_write_wakeup() is called after we call @uart_port->ops->start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140320193743.GM3959@saruman.home>
Date:	Thu, 20 Mar 2014 14:37:43 -0500
From:	Felipe Balbi <balbi@...com>
To:	Felipe Balbi <balbi@...com>
CC:	Greg KH <gregkh@...uxfoundation.org>,
	<linux-serial@...r.kernel.org>, <linux-bluetooth@...r.kernel.org>,
	<peter@...leysoftware.com>, <m-karicheri2@...com>,
	<b32955@...escale.com>,
	Linux OMAP Mailing List <linux-omap@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 08/11] In the uart_handle_cts_change(),
 uart_write_wakeup() is called after we call @uart_port->ops->start_tx().

Hi,


On Thu, Mar 20, 2014 at 02:30:04PM -0500, Felipe Balbi wrote:
> From: Huang Shijie <b32955@...escale.com>
> 
> The Documentation/serial/driver tells us:
> -----------------------------------------------
>   start_tx(port)
> 	Start transmitting characters.
> 
> 	Locking: port->lock taken.
> 	Interrupts: locally disabled.
> -----------------------------------------------
> 
> So when the uart_write_wakeup() is called, the port->lock is taken by
> the upper. See the following callstack:
> 
> 	|_ uart_write_wakeup
> 	   |_ tty_wakeup
> 	      |_ ld->ops->write_wakeup
> 
> With the port->lock held, we call the @write_wakeup. Some implemetation of
> the @write_wakeup does not notice that the port->lock is held, and it still
> tries to send data with uart_write() which will try to grab the prot->lock.
> A dead lock occurs, see the following log caught in the Bluetooth by uart:
> 
> --------------------------------------------------------------------
> BUG: spinlock lockup suspected on CPU#0, swapper/0/0
>  lock: 0xdc3f4410, .magic: dead4ead, .owner: swapper/0/0, .owner_cpu: 0
> CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W    3.10.17-16839-ge4a1bef #1320
> [<80014cbc>] (unwind_backtrace+0x0/0x138) from [<8001251c>] (show_stack+0x10/0x14)
> [<8001251c>] (show_stack+0x10/0x14) from [<802816ac>] (do_raw_spin_lock+0x108/0x184)
> [<802816ac>] (do_raw_spin_lock+0x108/0x184) from [<806a22b0>] (_raw_spin_lock_irqsave+0x54/0x60)
> [<806a22b0>] (_raw_spin_lock_irqsave+0x54/0x60) from [<802f5754>] (uart_write+0x38/0xe0)
> [<802f5754>] (uart_write+0x38/0xe0) from [<80455270>] (hci_uart_tx_wakeup+0xa4/0x168)
> [<80455270>] (hci_uart_tx_wakeup+0xa4/0x168) from [<802dab18>] (tty_wakeup+0x50/0x5c)
> [<802dab18>] (tty_wakeup+0x50/0x5c) from [<802f81a4>] (imx_rtsint+0x50/0x80)
> [<802f81a4>] (imx_rtsint+0x50/0x80) from [<802f88f4>] (imx_int+0x158/0x17c)
> [<802f88f4>] (imx_int+0x158/0x17c) from [<8007abe0>] (handle_irq_event_percpu+0x50/0x194)
> [<8007abe0>] (handle_irq_event_percpu+0x50/0x194) from [<8007ad60>] (handle_irq_event+0x3c/0x5c)
> --------------------------------------------------------------------
> 
> This patch adds more limits to the @write_wakeup, the one who wants to
> implemet the @write_wakeup should follow the limits which avoid the deadlock.
> 
> Signed-off-by: Huang Shijie <b32955@...escale.com>
> Signed-off-by: Felipe Balbi <balbi@...com>

patch came without a subject, Peter already sent it anyway, so Greg can
ignore this one.

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)