From: Ulf Hansson <ulf.hansson@linaro.org>
To: "Joe.Zhou" <Joe.Zhou@mediatek.com>
Cc: Peng.Zhou@mediatek.com, Sharp.Xia@mediatek.com,
Sophie.Wang@mediatek.com, Wey.Zhang@mediatek.com,
linux-mediatek@lists.infradead.org, linux-mmc@vger.kernel.org,
wsd_upstream@mediatek.com
Subject: Re: [PATCH] mmc: race condition between "sdcard hot plug out" and "system reboot"
Date: Mon, 6 May 2024 11:53:10 +0200 [thread overview]
Message-ID: <CAPDyKFrAp5SHL32LkZZA_nXekSa0HVVW2nQzMi9aOPnd90+N5A@mail.gmail.com> (raw)
In-Reply-To: <20240506033644.10538-1-Joe.Zhou@mediatek.com>
On Mon, 6 May 2024 at 05:36, Joe.Zhou <Joe.Zhou@mediatek.com> wrote:
>
> From: Joe Zhou <Joe.Zhou@mediatek.com>
>
> > Thanks for your patch!
>
> > Doesn't commit 66c915d09b94 ("mmc: core: Disable card detect during
> > shutdown") take care of this problem?
>
> > Kind regards
> > Uffe
>
>
> Dear Ulf,
> Thank you for your replay!
>
> I think that commit66c915d09b94 ("mmc: core: Disable card detect during shutdown") doesn't reslove this issue.
> 1. Issues may asise in the following processing.
> sdcard hot pulg out: SyS_reboot:
> CPU0 CPU1
> _mmc_detect_change() {
> ......
> mmc_schedule_delayed_work(&host->detect, delay)
> #Step1: call delay work &host->detect
> mmc_rescan()
> {
> .......
> #Step2: detect SD card removed
> mmc_sd_detect() { ......
> _mmc_stop_host (.pre_shutdown)
> {
> ...... #Step3:_mmc_stop_host() cancel detect use sync
> cancel_delayed_work_sync(&host->detect)
> #Step4: wait delay work complete
> }
> if (err) {
> #Step5: host->card is NULL
> mmc_sd_remove(host); ......
Via mmc_sd_detect() we are also calling device_del(card) and
mmc_detach_bus(). In other words, when _mmc_stop_host() has been
completed, the struct device corresponding to the card should have
been unregistered and host->bus_ops should be NULL.
In the later phase, mmc_bus_shutdown() seems to be called, which is
weird in the first place as the struct device should have been removed
from the bus. Then, even if that is the case, the host->bus_ops should
be NULL, thus it should rather lead to NULL pointer dereference splat
when accessing host->bus_ops->shutdown() callback.
What am I missing here?
> #Step6: wait delay work complete
> mmc_sd_suspend (.shutdown)
> {
> ......
>
> #Step7:_mmc_sd_suspend claimed host
> mmc_claim_host(host);
> #Step8: use host-card(NULL pointer)
> if (mmc_card_suspended(host->card))
> ......
> }
> mmc_claim_host(host);
> mmc_detach_bus(host);
> }
> }
> }
> ......
> }
>
> 2. And in the version that includes the patch, we have reproduced the issue.
Can you please send a detailed log-splat of what is happening?
Otherwise I may not be able to help.
>
> Best regards,
> Joe
Kind regards
Uffe
prev parent reply other threads:[~2024-05-06 9:53 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-08 10:38 [PATCH] mmc: race condition between "sdcard hot plug out" and "system reboot" Joe.Zhou
2024-04-25 9:49 ` Ulf Hansson
2024-05-06 3:36 ` Joe.Zhou
2024-05-06 9:53 ` Ulf Hansson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAPDyKFrAp5SHL32LkZZA_nXekSa0HVVW2nQzMi9aOPnd90+N5A@mail.gmail.com \
--to=ulf.hansson@linaro.org \
--cc=Joe.Zhou@mediatek.com \
--cc=Peng.Zhou@mediatek.com \
--cc=Sharp.Xia@mediatek.com \
--cc=Sophie.Wang@mediatek.com \
--cc=Wey.Zhang@mediatek.com \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-mmc@vger.kernel.org \
--cc=wsd_upstream@mediatek.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).