| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20240122150949.994249-32-sashal@kernel.org>
Date: Mon, 22 Jan 2024 10:08:33 -0500
From: Sasha Levin <sashal@...nel.org>
To: linux-kernel@...r.kernel.org,
stable@...r.kernel.org
Cc: Ming Qian <ming.qian@....com>,
Xiaolei Wang <xiaolei.wang@...driver.com>,
Hans Verkuil <hverkuil-cisco@...all.nl>,
Sasha Levin <sashal@...nel.org>,
eagle.zhou@....com,
mchehab@...nel.org,
linux-media@...r.kernel.org
Subject: [PATCH AUTOSEL 6.1 32/53] media: amphion: remove mutext lock in condition of wait_event
From: Ming Qian <ming.qian@....com>
[ Upstream commit f9c8ddce2fe3b767582f299d03fc8fb85943568c ]
mutext_lock should not be called in condition of wait_event, otherwise,
when CONFIG_DEBUG_ATOMIC_SLEEP is enabled, we may meet the following
warning:
do not call blocking ops when !TASK_RUNNING; state=2
WARNING: CPU: 5 PID: 741 at kernel/sched/core.c:9859
__might_sleep+0x80/0xa4
Hardware name: Freescale i.MX8QM MEK (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc :
__might_sleep+0x80/0xa4 lr : __might_sleep+0x80/0xa4 sp : ffffffc0123738a0
x29: ffffffc0123738a0 x28: ffffffc009194c48 x27: ffffffc00bbc1050
x26: ffffff8814b282f0 x25: ffffff8814b280d0 x24: ffffff8814b28080
x23: 0000000000000001 x22: 0000000000000032 x21: ffffffc00bbc1000
x20: 000000000000011b x19: ffffffc009324670 x18: 00000000fffffffd
x17: 30303c5b20746120 x16: 74657320323d6574 x15: 617473203b474e49
x14: 00058b5b8b9aa1f1 x13: ffffffc00903cda0 x12: 00000000d744fcc9
x11: 000000000000001c x10: 00000000000009a0 x9 : ffffffc0090201f4
x8 : ffffff8828245000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : 00000000410fd080 x4 : 0000000000000002 x3 : ffffff8815aab4c8
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffff8828244600
Call trace:
__might_sleep+0x80/0xa4
mutex_lock+0x2c/0x80
sync_session_response+0x110/0x310
vpu_session_send_cmd+0x18c/0x244
vpu_session_start+0x38/0x70
vdec_start_session+0x1b4/0x3e0
vpu_vb2_start_streaming+0xa0/0x1c4
vb2_start_streaming+0x74/0x160
vb2_core_qbuf+0x488/0x650
vb2_qbuf+0x9c/0x100
v4l2_m2m_qbuf+0x7c/0x224
v4l2_m2m_ioctl_qbuf+0x20/0x2c
v4l_qbuf+0x50/0x6c
__video_do_ioctl+0x174/0x3f0
video_usercopy+0x210/0x7cc
video_ioctl2+0x20/0x30
v4l2_ioctl+0x48/0x6c
we need to refine check_is_responsed() to remove the mutext_lock, each
cmd has a monotonically increasing id, and cmds are executed
sequentially, so we can check the id of the last reponsed cmd, then
determine whether a command has been responded or not.
Signed-off-by: Ming Qian <ming.qian@....com>
CC: Xiaolei Wang <xiaolei.wang@...driver.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@...all.nl>
Signed-off-by: Sasha Levin <sashal@...nel.org>
---
drivers/media/platform/amphion/vpu.h | 3 ++-
drivers/media/platform/amphion/vpu_cmds.c | 28 ++++++++---------------
drivers/media/platform/amphion/vpu_v4l2.c | 1 +
3 files changed, 12 insertions(+), 20 deletions(-)
diff --git a/drivers/media/platform/amphion/vpu.h b/drivers/media/platform/amphion/vpu.h
index deb2288d4290..4f3d23b55b6d 100644
--- a/drivers/media/platform/amphion/vpu.h
+++ b/drivers/media/platform/amphion/vpu.h
@@ -152,7 +152,6 @@ struct vpu_core {
struct vpu_mbox tx_type;
struct vpu_mbox tx_data;
struct vpu_mbox rx;
- unsigned long cmd_seq;
wait_queue_head_t ack_wq;
struct completion cmp;
@@ -251,6 +250,8 @@ struct vpu_inst {
struct list_head cmd_q;
void *pending;
+ unsigned long cmd_seq;
+ atomic_long_t last_response_cmd;
struct vpu_inst_ops *ops;
const struct vpu_format *formats;
diff --git a/drivers/media/platform/amphion/vpu_cmds.c b/drivers/media/platform/amphion/vpu_cmds.c
index 235b71398d40..c68163af29dc 100644
--- a/drivers/media/platform/amphion/vpu_cmds.c
+++ b/drivers/media/platform/amphion/vpu_cmds.c
@@ -34,6 +34,7 @@ struct vpu_cmd_t {
struct vpu_cmd_request *request;
struct vpu_rpc_event *pkt;
unsigned long key;
+ atomic_long_t *last_response_cmd;
};
static struct vpu_cmd_request vpu_cmd_requests[] = {
@@ -117,6 +118,8 @@ static void vpu_free_cmd(struct vpu_cmd_t *cmd)
{
if (!cmd)
return;
+ if (cmd->last_response_cmd)
+ atomic_long_set(cmd->last_response_cmd, cmd->key);
vfree(cmd->pkt);
vfree(cmd);
}
@@ -174,7 +177,8 @@ static int vpu_request_cmd(struct vpu_inst *inst, u32 id, void *data,
return -ENOMEM;
mutex_lock(&core->cmd_lock);
- cmd->key = core->cmd_seq++;
+ cmd->key = ++inst->cmd_seq;
+ cmd->last_response_cmd = &inst->last_response_cmd;
if (key)
*key = cmd->key;
if (sync)
@@ -248,26 +252,12 @@ void vpu_clear_request(struct vpu_inst *inst)
static bool check_is_responsed(struct vpu_inst *inst, unsigned long key)
{
- struct vpu_core *core = inst->core;
- struct vpu_cmd_t *cmd;
- bool flag = true;
+ unsigned long last_response = atomic_long_read(&inst->last_response_cmd);
- mutex_lock(&core->cmd_lock);
- cmd = inst->pending;
- if (cmd && key == cmd->key) {
- flag = false;
- goto exit;
- }
- list_for_each_entry(cmd, &inst->cmd_q, list) {
- if (key == cmd->key) {
- flag = false;
- break;
- }
- }
-exit:
- mutex_unlock(&core->cmd_lock);
+ if (key <= last_response && (last_response - key) < (ULONG_MAX >> 1))
+ return true;
- return flag;
+ return false;
}
static int sync_session_response(struct vpu_inst *inst, unsigned long key, long timeout, int try)
diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
index e5c8e1a753cc..e7a18948c4ab 100644
--- a/drivers/media/platform/amphion/vpu_v4l2.c
+++ b/drivers/media/platform/amphion/vpu_v4l2.c
@@ -631,6 +631,7 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst)
func = &vpu->decoder;
atomic_set(&inst->ref_count, 0);
+ atomic_long_set(&inst->last_response_cmd, 0);
vpu_inst_get(inst);
inst->vpu = vpu;
inst->core = vpu_request_core(vpu, inst->type);
--
2.43.0
Powered by blists - more mailing lists