From patchwork Wed Sep 27 18:19:39 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Chengfeng Ye X-Patchwork-Id: 13401521 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BD50BE82CBB for ; Wed, 27 Sep 2023 18:20:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:List-Subscribe:List-Help: List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date:Subject:Cc:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=6+xgJ0QufX9MJo6msi7/RTo8G3S8Xxtd9Eg4rPRGTcs=; b=aVuWCinxv+ilVD 2lfUCPyC8r5nnc6ANxBQZibzdg2UFvT5PMQ5NFWss6EKAD37yRNH5K3jvhfBTJEEfPovgJ9bDpFAU 7xOVDt392wnzuE1QC3zi9oeBYb6cqFyHu6hsDh1EsmajWXZr7qMbfqVQdNsvbjrSz+5nSQ+R+MteX bvblpO5ooNVgXuIwKIFRp6wRoppo4uOxlti692ob3sW4cdDsU1S598R985PWjAx5fWh/HGp/CXvNw khE2W9CxJEEsCOEVk6QSmwHzh5vOD43sdaKfz49/h6XYq8K+mz0ymAkkwUeYLsINlnW6ZZkaTkjCM au1DYBjZxkD35FbwZaLg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qlZ8u-001Zaz-0g; Wed, 27 Sep 2023 18:20:12 +0000 Received: from mail-pf1-x42e.google.com ([2607:f8b0:4864:20::42e]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qlZ8r-001ZZz-2D for linux-arm-kernel@lists.infradead.org; Wed, 27 Sep 2023 18:20:10 +0000 Received: by mail-pf1-x42e.google.com with SMTP id d2e1a72fcca58-69101022969so10574416b3a.3 for ; Wed, 27 Sep 2023 11:20:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1695838806; x=1696443606; darn=lists.infradead.org; h=message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=u5B3VoFkvJ3Kkt4BU0WJl0+BQwyfXbEUUwHbI2QcpnY=; b=F31dUojR3YBYs1lO8OLF2WGbr58f9jnOxgx5o/1Rm/jkYSDGre9nf23kuAx4vH2ab2 9xI4BKgWVK0EUER+w4WP5ic6xFqIkfg0tpIuRwJAgY7vqPidvwlZKd/LCCLoJnHIsrvQ xpnNYOd/VyHFoNlkdr9m/DbiZwZsLxmT11wjmMj6xX5sUeDq+w6FCeHs1n0omJESWlnG Awr7IIlXnp3PEsm9QcdOmzIT9rDda/0k+7O6/gL1NnClcKBvMFxjTBug36nLCb1HNepR rEP9u6ICSloz7SPgLslFivgU9ew2ACM2B8KMCJM2hO4Iuw41nkTHuxOHJI9HMt5mkKGR NrcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695838806; x=1696443606; h=message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=u5B3VoFkvJ3Kkt4BU0WJl0+BQwyfXbEUUwHbI2QcpnY=; b=r7A7emA9hDwIr9SLNdLjZe1BZZ9Rk1dbKfFwLcFiUVZA56sPyen3JjA67SrCynrl7k tEBKAMhvXkNFm5sC2BNgOfqgJMMRUq4ZoThzxzglPM7Wm273+LC9PfhKka4qb7e6q/JP u3Iv/NOR8Bb7aOQJu29ods2Bhv5edP8aGDrnqBhnb6bSIth53khrMiOgYsWablEALCHx ZDGAfwF/U/b+3P9RLkwFmso6bjmfSgTv0Saa3jCLddWzOq3UluyXPf85aEZ/E3p3tE9G RDl5LYXc5wk3F0urLpwtdMZSlAYZaKopesBbpSrFU3vQtdqLvLIUBxJ7T7jRyvlTX/ND m/vw== X-Gm-Message-State: AOJu0YwDXYMjJDWzY1MPpacQ0IQIke6VDNIYdh+DiNabWPEVVw86vSq5 rejb4DpiZChvPdLHy9c3ayE= X-Google-Smtp-Source: AGHT+IGwuIFY5ERDx4cHwOm/e+K0VXyYRtVSOWopBVjwpR89TArQj9id/SpVD4k2iqu8pe/g4IRmpQ== X-Received: by 2002:a05:6a21:2728:b0:15e:96d3:a31b with SMTP id rm40-20020a056a21272800b0015e96d3a31bmr2432976pzb.39.1695838805878; Wed, 27 Sep 2023 11:20:05 -0700 (PDT) Received: from 377044c6c369.cse.ust.hk (191host097.mobilenet.cse.ust.hk. [143.89.191.97]) by smtp.gmail.com with ESMTPSA id x6-20020aa793a6000000b0068c006dd5c1sm475047pff.115.2023.09.27.11.20.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 27 Sep 2023 11:20:05 -0700 (PDT) From: Chengfeng Ye To: gregkh@linuxfoundation.org, jirislaby@kernel.org, shawnguo@kernel.org, s.hauer@pengutronix.de, kernel@pengutronix.de, sorganov@gmail.com, festevam@gmail.com, ilpo.jarvinen@linux.intel.com Cc: linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Chengfeng Ye Subject: [PATCH RESEND] serial: imx: Fix potential deadlock on sport->port.lock Date: Wed, 27 Sep 2023 18:19:39 +0000 Message-Id: <20230927181939.60554-1-dg573847474@gmail.com> X-Mailer: git-send-email 2.17.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230927_112009_730448_AC3111A4 X-CRM114-Status: GOOD ( 13.05 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org As &sport->port.lock is acquired under irq context along the following call chain from imx_uart_rtsint(), other acquisition of the same lock inside process context or softirq context should disable irq avoid double lock. imx_uart_dma_rx_callback() --> spin_lock(&sport->port.lock) --> imx_uart_rtsint() --> spin_lock(&sport->port.lock) This flaw was found by an experimental static analysis tool I am developing for irq-related deadlock. To prevent the potential deadlock, the patch uses spin_lock_irqsave() on the &sport->port.lock inside imx_uart_dma_rx_callback() to prevent the possible deadlock scenario. Signed-off-by: Chengfeng Ye Acked-by: Uwe Kleine-König --- drivers/tty/serial/imx.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c index 13cb78340709..7bb3aa19d51c 100644 --- a/drivers/tty/serial/imx.c +++ b/drivers/tty/serial/imx.c @@ -1165,13 +1165,14 @@ static void imx_uart_dma_rx_callback(void *data) unsigned int w_bytes = 0; unsigned int r_bytes; unsigned int bd_size; + unsigned long flags; status = dmaengine_tx_status(chan, sport->rx_cookie, &state); if (status == DMA_ERROR) { - spin_lock(&sport->port.lock); + spin_lock_irqsave(&sport->port.lock, flags); imx_uart_clear_rx_errors(sport); - spin_unlock(&sport->port.lock); + spin_unlock_irqrestore(&sport->port.lock, flags); return; } @@ -1200,9 +1201,9 @@ static void imx_uart_dma_rx_callback(void *data) r_bytes = rx_ring->head - rx_ring->tail; /* If we received something, check for 0xff flood */ - spin_lock(&sport->port.lock); + spin_lock_irqsave(&sport->port.lock, flags); imx_uart_check_flood(sport, imx_uart_readl(sport, USR2)); - spin_unlock(&sport->port.lock); + spin_unlock_irqrestore(&sport->port.lock, flags); if (!(sport->port.ignore_status_mask & URXD_DUMMY_READ)) {