linux-kernel - Re: [PATCH 2/2] media: venus: sync with threaded IRQ during inst destruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241024054639.GL1279924@google.com>
Date: Thu, 24 Oct 2024 14:46:39 +0900
From: Sergey Senozhatsky <senozhatsky@...omium.org>
To: Tomasz Figa <tfiga@...omium.org>
Cc: Sergey Senozhatsky <senozhatsky@...omium.org>,
	Stanimir Varbanov <stanimir.k.varbanov@...il.com>,
	Vikash Garodia <quic_vgarodia@...cinc.com>,
	Bryan O'Donoghue <bryan.odonoghue@...aro.org>,
	linux-media@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] media: venus: sync with threaded IRQ during inst
 destruction

On (24/10/24 14:18), Tomasz Figa wrote:
> > @@ -1538,9 +1538,25 @@ static int venc_close(struct file *file)
> >
> >         venc_pm_get(inst);
> >
> > +       /*
> > +        * First, remove the inst from the ->instances list, so that
> > +        * to_instance() will return NULL.
> > +        */
> > +       hfi_session_destroy(inst);
> > +       /*
> > +        * Second, make sure we don't have IRQ/IRQ-thread currently running or
> > +        * pending execution (disable_irq() calls synchronize_irq()), which
> > +        * can race with the inst destruction.
> > +        */
> > +       disable_irq(inst->core->irq);
> > +       /*
> > +        * Lastly, inst is gone from the core->instances list and we don't
> > +        * have running/pending IRQ/IRQ-thread, proceed with the destruction
> > +        */
> > +       enable_irq(inst->core->irq);
> > +
> 
> Thanks a lot for looking into this. Wouldn't it be enough to just call
> synchronize_irq() at this point, since the instance was removed from
> the list already? I guess the question is if that's the only way the
> interrupt handler can get hold of the instance.

Good question.

synchronize_irq() waits for IRQ-threads, so if inst is accessed only from
IRQ-thread then we are fine.  If, however, inst is also accessed from hard
IRQ, then synchronize_irq() won't work, I guess, because it doesn't wait
for "in flight hard IRQs".  disable_irq() OTOH "waits for completion", so
we cover in-flight hard IRQs too.