From patchwork Thu Feb 21 15:49:49 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabio Estevam X-Patchwork-Id: 2171841 Return-Path: X-Original-To: patchwork-linux-mmc@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 02049DF215 for ; Thu, 21 Feb 2013 15:32:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754266Ab3BUPc1 (ORCPT ); Thu, 21 Feb 2013 10:32:27 -0500 Received: from tx2ehsobe003.messaging.microsoft.com ([65.55.88.13]:21462 "EHLO tx2outboundpool.messaging.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754262Ab3BUPc0 (ORCPT ); Thu, 21 Feb 2013 10:32:26 -0500 Received: from mail144-tx2-R.bigfish.com (10.9.14.250) by TX2EHSOBE002.bigfish.com (10.9.40.22) with Microsoft SMTP Server id 14.1.225.23; Thu, 21 Feb 2013 15:32:26 +0000 Received: from mail144-tx2 (localhost [127.0.0.1]) by mail144-tx2-R.bigfish.com (Postfix) with ESMTP id E0E8A160257; Thu, 21 Feb 2013 15:32:25 +0000 (UTC) X-Forefront-Antispam-Report: CIP:70.37.183.190; KIP:(null); UIP:(null); IPV:NLI; H:mail.freescale.net; RD:none; EFVD:NLI X-SpamScore: -1 X-BigFish: VS-1(z54eehz98dIzz1f42h1ee6h1de0h1202h1e76h1d1ah1d2ahzzz2dh2a8h668h839h944hd25he5bhf0ah1220h1288h12a5h12a9h12bdh137ah13b6h1441h1504h1537h153bh162dh1631h1758h1765h18e1h1946h19c3h1155h) Received: from mail144-tx2 (localhost.localdomain [127.0.0.1]) by mail144-tx2 (MessageSwitch) id 1361460744767129_5579; Thu, 21 Feb 2013 15:32:24 +0000 (UTC) Received: from TX2EHSMHS035.bigfish.com (unknown [10.9.14.242]) by mail144-tx2.bigfish.com (Postfix) with ESMTP id B5DA63C00D0; Thu, 21 Feb 2013 15:32:24 +0000 (UTC) Received: from mail.freescale.net (70.37.183.190) by TX2EHSMHS035.bigfish.com (10.9.99.135) with Microsoft SMTP Server (TLS) id 14.1.225.23; Thu, 21 Feb 2013 15:32:24 +0000 Received: from az84smr01.freescale.net (10.64.34.197) by 039-SN1MMR1-002.039d.mgd.msft.net (10.84.1.15) with Microsoft SMTP Server (TLS) id 14.2.328.11; Thu, 21 Feb 2013 15:32:21 +0000 Received: from [10.29.244.55] ([10.29.244.55]) by az84smr01.freescale.net (8.14.3/8.14.0) with ESMTP id r1LFWARw022511; Thu, 21 Feb 2013 08:32:12 -0700 Message-ID: <5126421D.7010204@freescale.com> Date: Thu, 21 Feb 2013 12:49:49 -0300 From: Fabio Estevam Organization: Freescale Semiconductor User-Agent: Thunderbird 2.0.0.24 (X11/20100317) MIME-Version: 1.0 To: Anatolij Gustschin CC: Javier Martin , , , , , , , , Subject: Re: [PATCH v2] mmc: mxcmmc: fix bug that may block a data transfer forever. References: <1347014617-16238-1-git-send-email-javier.martin@vista-silicon.com> <20130219151414.2aa318d7@crub> In-Reply-To: <20130219151414.2aa318d7@crub> X-OriginatorOrg: freescale.com Sender: linux-mmc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-mmc@vger.kernel.org Hi Anatolij, Anatolij Gustschin wrote: > this change introduces a race condition for host->req (and maybe > for host->data) accesses. The callback is running in soft-irq context and can > be interrupted by the mxcmci_irq() interrupt which can finish the request and > set host->req to NULL. Then mxcmci_data_done() crashes with a null pointer > dereference. How extensively was it tested? Does the patch below help? --- To unsubscribe from this list: send the line "unsubscribe linux-mmc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/drivers/mmc/host/mxcmmc.c +++ b/drivers/mmc/host/mxcmmc.c @@ -309,9 +309,11 @@ static void mxcmci_dma_callback(void *data) { struct mxcmci_host *host = data; u32 stat; + unsigned int long flags; del_timer(&host->watchdog); + spin_lock_irqsave(&host->lock, flags); stat = readl(host->base + MMC_REG_STATUS); writel(stat & ~STATUS_DATA_TRANS_DONE, host->base + MMC_REG_STATUS); @@ -320,6 +322,7 @@ static void mxcmci_dma_callback(void *data) if (stat & STATUS_READ_OP_DONE) writel(STATUS_READ_OP_DONE, host->base + MMC_REG_STATUS); + spin_unlock_irqrestore(&host->lock, flags); mxcmci_data_done(host, stat); }