linux-kernel - Re: [PATCH v2 2/3] usb: typec: ucsi: Move unregister out of atomic section

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZsQ696Jq5aO8IMKG@hovoldconsulting.com>
Date: Tue, 20 Aug 2024 08:43:03 +0200
From: Johan Hovold <johan@...nel.org>
To: Bjorn Andersson <quic_bjorande@...cinc.com>
Cc: Sebastian Reichel <sre@...nel.org>,
	Bjorn Andersson <andersson@...nel.org>,
	Konrad Dybcio <konrad.dybcio@...aro.org>,
	Heikki Krogerus <heikki.krogerus@...ux.intel.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Neil Armstrong <neil.armstrong@...aro.org>,
	Johan Hovold <johan+linaro@...nel.org>,
	Chris Lew <quic_clew@...cinc.com>,
	Dmitry Baryshkov <dmitry.baryshkov@...aro.org>,
	Stephen Boyd <swboyd@...omium.org>,
	Amit Pundir <amit.pundir@...aro.org>, linux-arm-msm@...r.kernel.org,
	linux-pm@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-usb@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v2 2/3] usb: typec: ucsi: Move unregister out of atomic
 section

On Mon, Aug 19, 2024 at 01:07:46PM -0700, Bjorn Andersson wrote:
> Commit '635ce0db8956 ("soc: qcom: pmic_glink: don't traverse clients

Looks like you copied the wrong SHA again. This should be

	9329933699b3 ("soc: qcom: pmic_glink: Make client-lock non-sleeping")

as we discussed.

> list without a lock")' moved the pmic_glink client list under a
> spinlock, as it is accessed by the rpmsg/glink callback, which in turn
> is invoked from IRQ context.
> 
> This means that ucsi_unregister() is now called from IRQ context, which

And this should be "atomic context" as pdr notifications are done from
a worker thread.

> isn't feasible as it's expecting a sleepable context. An effort is under
> way to get GLINK to invoke its callbacks in a sleepable context, but
> until then lets schedule the unregistration.
> 
> A side effect of this is that ucsi_unregister() can now happen
> after the remote processor, and thereby the communication link with it, is
> gone. pmic_glink_send() is amended with a check to avoid the resulting NULL
> pointer dereference.
> This does however result in the user being informed about this error by
> the following entry in the kernel log:
> 
>   ucsi_glink.pmic_glink_ucsi pmic_glink.ucsi.0: failed to send UCSI write request: -5
> 
> Fixes: 635ce0db8956 ("soc: qcom: pmic_glink: don't traverse clients list without a lock")

Fixes: 9329933699b3 ("soc: qcom: pmic_glink: Make client-lock non-sleeping")

> Cc: stable@...r.kernel.org
> Reviewed-by: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
> Reviewed-by: Neil Armstrong <neil.armstrong@...aro.org>
> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
> Tested-by: Amit Pundir <amit.pundir@...aro.org>
> Signed-off-by: Bjorn Andersson <quic_bjorande@...cinc.com>

> @@ -269,11 +284,12 @@ static void pmic_glink_ucsi_callback(const void *data, size_t len, void *priv)
>  static void pmic_glink_ucsi_pdr_notify(void *priv, int state)
>  {
>  	struct pmic_glink_ucsi *ucsi = priv;
> +	unsigned long flags;
>  
> -	if (state == SERVREG_SERVICE_STATE_UP)
> -		schedule_work(&ucsi->register_work);
> -	else if (state == SERVREG_SERVICE_STATE_DOWN)
> -		ucsi_unregister(ucsi->ucsi);
> +	spin_lock_irqsave(&ucsi->state_lock, flags);
> +	ucsi->pd_running = state == SERVREG_SERVICE_STATE_UP;

Add parentheses for readability?

> +	spin_unlock_irqrestore(&ucsi->state_lock, flags);
> +	schedule_work(&ucsi->register_work);
>  }
>  
>  static void pmic_glink_ucsi_destroy(void *data)
> @@ -320,6 +336,7 @@ static int pmic_glink_ucsi_probe(struct auxiliary_device *adev,
>  	INIT_WORK(&ucsi->register_work, pmic_glink_ucsi_register);
>  	init_completion(&ucsi->read_ack);
>  	init_completion(&ucsi->write_ack);
> +	spin_lock_init(&ucsi->state_lock);
>  	mutex_init(&ucsi->lock);
>  
>  	ucsi->ucsi = ucsi_create(dev, &pmic_glink_ucsi_ops);

Looks good otherwise:

Reviewed-by: Johan Hovold <johan+linaro@...nel.org>

Johan