linux-kernel - Re: [PATCH V1 1/2] mmc: core: Check request type before completing the request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 6 May 2020 20:06:29 +0300
From:   Adrian Hunter <adrian.hunter@...el.com>
To:     Veerabhadrarao Badiganti <vbadigan@...eaurora.org>,
        ulf.hansson@...aro.org
Cc:     stummala@...eaurora.org, linux-mmc@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-arm-msm@...r.kernel.org,
        stable@...r.kernel.org, Baolin Wang <baolin.wang@...aro.org>,
        Avri Altman <avri.altman@....com>,
        Chaotian Jing <chaotian.jing@...iatek.com>,
        Arnd Bergmann <arnd@...db.de>
Subject: Re: [PATCH V1 1/2] mmc: core: Check request type before completing
 the request

On 6/05/20 5:34 pm, Veerabhadrarao Badiganti wrote:
> In the request completion path with CQE, request type is being checked
> after the request is getting completed. This is resulting in returning
> the wrong request type and leading to the IO hang issue.
> 
> ASYNC request type is getting returned for DCMD type requests.
> Because of this mismatch, mq->cqe_busy flag is never getting cleared
> and the driver is not invoking blk_mq_hw_run_queue. So requests are not
> getting dispatched to the LLD from the block layer.
> 
> All these eventually leading to IO hang issues.
> So, get the request type before completing the request.
> 
> Cc: <stable@...r.kernel.org> # v4.19+

The fixed commit was in 4.16

> Signed-off-by: Veerabhadrarao Badiganti <vbadigan@...eaurora.org>

Fixes: 1e8e55b67030 ("mmc: block: Add CQE support")
Acked-by: Adrian Hunter <adrian.hunter@...el.com>

Thank you for finding this!

> ---
>  drivers/mmc/core/block.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
> index 8499b56..c5367e2 100644
> --- a/drivers/mmc/core/block.c
> +++ b/drivers/mmc/core/block.c
> @@ -1370,6 +1370,7 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req)
>  	struct mmc_request *mrq = &mqrq->brq.mrq;
>  	struct request_queue *q = req->q;
>  	struct mmc_host *host = mq->card->host;
> +	enum mmc_issue_type issue_type = mmc_issue_type(mq, req);
>  	unsigned long flags;
>  	bool put_card;
>  	int err;
> @@ -1399,7 +1400,7 @@ static void mmc_blk_cqe_complete_rq(struct mmc_queue *mq, struct request *req)
>  
>  	spin_lock_irqsave(&mq->lock, flags);
>  
> -	mq->in_flight[mmc_issue_type(mq, req)] -= 1;
> +	mq->in_flight[issue_type] -= 1;
>  
>  	put_card = (mmc_tot_in_flight(mq) == 0);
>  
>