From patchwork Tue Sep 26 10:53:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chengfeng Ye X-Patchwork-Id: 13399077 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 551BFE7D27B for ; Tue, 26 Sep 2023 10:54:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:List-Subscribe:List-Help: List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date:Subject:Cc:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=0ho0ftjGI1Cy64GmfEnlthT5/XVSKfm8sfuNBPDXfyQ=; b=e8sI7gSixGa2on jmNLsN5MITfjn1QHXbIK5BHBMXm1XZY0uy/6OFf+LPgGV09Fara4qx+j4gwCbc/lAhWblm8mt1tv7 /xAVAnFirub9tbZAIl0bsJ/exyD0rxJB2PSe6nBXYLzL5SLZgB89Ec4PYqndlCEEzbKLZWbv7FWcR 8ORuO4Z0C+XjtZuCbLjPGYHtf1vW7LTxC54Cd6JtwIvpI/YkXwalO0DVGaAbTvKcnNXlINUcnUZbV syeURuNWpQcJBSLXWW0TxjKtO+ZZbrNu2rMei9Z8hn02USsZNuqOliUuNVwSfJkut5+coGFpkJAQK aTkjMKChtjEMJaeHV6YA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1ql5hE-00GCSX-1h; Tue, 26 Sep 2023 10:53:40 +0000 Received: from mail-pg1-x52f.google.com ([2607:f8b0:4864:20::52f]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1ql5hB-00GCRi-2Q for linux-arm-kernel@lists.infradead.org; Tue, 26 Sep 2023 10:53:38 +0000 Received: by mail-pg1-x52f.google.com with SMTP id 41be03b00d2f7-584a761b301so974949a12.3 for ; Tue, 26 Sep 2023 03:53:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1695725615; x=1696330415; darn=lists.infradead.org; h=message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=sIOtiw4Vu/5LT/q28eVE3Dtmyg66prHjYei1I5nWOjs=; b=EqyKSdZomXul8km8BcMYYHaDVyBBBGb9kciNj3t4CfVb1l3fNMoSZWUGma1AkhyHqO 7hA+eTZwdxORcye0lCmCuyfqXLUUVGO1yCnHsRtvqgIMtKPgFU2bxiWtTY+ZbQ5g+7vx KcbqHF5hJnbdAeoRHaMP9tHDBDjunmJIAi2ltwm6G4WA8OzC/qmkl39mDt30A5X3CHhj ylNe68em59GTTSw7cvnrFmKuwKhETpG8YQ/ah6jBvYEo9OCrDgRrnOLTEkIlqYxUd7+x DIM5RUz+8f2iucl3WDB9M3qx1X228ZDUJ2fn8DU03+Y5pAzNhIULBIRpx/U1fTU9MDfa 34CQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695725615; x=1696330415; h=message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=sIOtiw4Vu/5LT/q28eVE3Dtmyg66prHjYei1I5nWOjs=; b=DlYurJi10p1r8vVr9BQKUZwwUxxWyAntoVeBg4m8nqXdfDoNz/GpeJASzhIr0kH76e J81kjpyspC7DYJ8ZwmbnwNX/JFVMnr/nf6SZwlcXr6UM7wq93BYrt7UNx2GFj3OFwWoR A6938yRnIrgC9vPJ0ae8VMzzjh8n3m146/H2Fz23lqRosscwfuZNWDenhuSioigewgJV QLkBI8KngLV48a1gXcEuKl5clPczz/6lAhFQvnLTgQdGSTR5Ts2cwl2ns0DAIYneQKO1 TIhJOJAfZJZPZYj9cwEs86HjFr+4a1SV6W+38EyTOA07tHB6hWx7bH6XHBWoQBZ0Zvfc XK7g== X-Gm-Message-State: AOJu0YyH8+Ka1KJGGhAYNVLYNe+z+wMbw2sf5Mj3Q6kx1kGmx1OnhShf LmTFZ4EpgxOZi67+tJGAFwc4nx5zGcBOOQ== X-Google-Smtp-Source: AGHT+IGNucwzMarZ64hyme5OSMHfFeU8XflGBVJxo1PNxfECkFjBUPA9h6rwr6R1/vrmIvpw06cCnQ== X-Received: by 2002:a05:6a20:3ba8:b0:15d:ccf3:939c with SMTP id b40-20020a056a203ba800b0015dccf3939cmr9074771pzh.35.1695725614578; Tue, 26 Sep 2023 03:53:34 -0700 (PDT) Received: from 377044c6c369.cse.ust.hk (191host097.mobilenet.cse.ust.hk. [143.89.191.97]) by smtp.gmail.com with ESMTPSA id y3-20020a170902864300b001bdc8a5e96csm10645022plt.169.2023.09.26.03.53.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 Sep 2023 03:53:34 -0700 (PDT) From: Chengfeng Ye To: m.szyprowski@samsung.com, andrzej.hajda@intel.com, mchehab@kernel.org Cc: linux-arm-kernel@lists.infradead.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Chengfeng Ye Subject: [PATCH] media: s5p-mfc: Fix potential deadlock on condlock Date: Tue, 26 Sep 2023 10:53:30 +0000 Message-Id: <20230926105330.10281-1-dg573847474@gmail.com> X-Mailer: git-send-email 2.17.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230926_035337_792650_3B716ADC X-CRM114-Status: GOOD ( 14.06 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org As &dev->condlock is acquired under irq context along the following call chain from s5p_mfc_irq(), other acquisition of the same lock inside process context or softirq context should disable irq avoid double lock. enc_post_frame_start() seems to be one such function that execute under process context or softirq context. enc_post_frame_start() --> clear_work_bit() --> spin_loc(&dev->condlock) --> s5p_mfc_irq() --> s5p_mfc_handle_frame() --> clear_work_bit() --> spin_lock(&dev->condlock) This flaw was found by an experimental static analysis tool I am developing for irq-related deadlock. To prevent the potential deadlock, the patch change clear_work_bit() inside enc_post_frame_start() to clear_work_bit_irqsave(). Signed-off-by: Chengfeng Ye Acked-by: Marek Szyprowski --- drivers/media/platform/samsung/s5p-mfc/s5p_mfc_enc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_enc.c b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_enc.c index f62703cebb77..4b4c129c09e7 100644 --- a/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_enc.c +++ b/drivers/media/platform/samsung/s5p-mfc/s5p_mfc_enc.c @@ -1297,7 +1297,7 @@ static int enc_post_frame_start(struct s5p_mfc_ctx *ctx) if (ctx->state == MFCINST_FINISHING && ctx->ref_queue_cnt == 0) src_ready = false; if (!src_ready || ctx->dst_queue_cnt == 0) - clear_work_bit(ctx); + clear_work_bit_irqsave(ctx); return 0; }