From: Ming Lei <ming.lei@canonical.com>
To: Linus Torvalds <torvalds@linux-foundation.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>,
Borislav Petkov <borislav.petkov@amd.com>,
linux-kernel@vger.kernel.org, Ming Lei <ming.lei@canonical.com>
Subject: [RFC PATCH v1 02/15] firmware loader: fix races during loading firmware
Date: Sat, 4 Aug 2012 12:01:17 +0800 [thread overview]
Message-ID: <1344052890-31935-3-git-send-email-ming.lei@canonical.com> (raw)
In-Reply-To: <1344052890-31935-1-git-send-email-ming.lei@canonical.com>
This patch fixes two races in loading firmware:
1, FW_STATUS_DONE should be set before waking up the task waitting
on _request_firmware_load, otherwise FW_STATUS_ABORT may be
thought as DONE mistakenly.
2, Inside _request_firmware_load(), there is a small window between
wait_for_completion() and mutex_lock(&fw_lock), and 'echo 1 > loading'
still may happen during the period, so this patch checks FW_STATUS_DONE
to prevent pages' buffer completed from being freed in firmware_loading_store.
Signed-off-by: Ming Lei <ming.lei@canonical.com>
---
drivers/base/firmware_class.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 1cbefcf..1915ad8 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -243,18 +243,21 @@ static ssize_t firmware_loading_store(struct device *dev,
switch (loading) {
case 1:
/* discarding any previous partial load */
- for (i = 0; i < fw_priv->nr_pages; i++)
- __free_page(fw_priv->pages[i]);
- kfree(fw_priv->pages);
- fw_priv->pages = NULL;
- fw_priv->page_array_size = 0;
- fw_priv->nr_pages = 0;
- set_bit(FW_STATUS_LOADING, &fw_priv->status);
+ if (!test_bit(FW_STATUS_DONE, &fw_priv->status)) {
+ for (i = 0; i < fw_priv->nr_pages; i++)
+ __free_page(fw_priv->pages[i]);
+ kfree(fw_priv->pages);
+ fw_priv->pages = NULL;
+ fw_priv->page_array_size = 0;
+ fw_priv->nr_pages = 0;
+ set_bit(FW_STATUS_LOADING, &fw_priv->status);
+ }
break;
case 0:
if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
- complete(&fw_priv->completion);
+ set_bit(FW_STATUS_DONE, &fw_priv->status);
clear_bit(FW_STATUS_LOADING, &fw_priv->status);
+ complete(&fw_priv->completion);
break;
}
/* fallthrough */
@@ -557,7 +560,6 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,
wait_for_completion(&fw_priv->completion);
- set_bit(FW_STATUS_DONE, &fw_priv->status);
del_timer_sync(&fw_priv->timeout);
mutex_lock(&fw_lock);
--
1.7.9.5
next prev parent reply other threads:[~2012-08-04 4:02 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-04 4:01 [RFC PATCH v1 00/15] firmware loader: introduce cache/uncache firmware Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 01/15] firmware loader: simplify pages ownership transfer Ming Lei
2012-08-04 4:01 ` Ming Lei [this message]
2012-08-04 4:01 ` [RFC PATCH v1 03/15] firmware loader: remove unnecessary wmb() Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 04/15] firmware loader: fix creation failure of fw loader device Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 05/15] firmware loader: introduce firmware_buf Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 06/15] firmware loader: always let firmware_buf own the pages buffer Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 07/15] firmware loader: introduce cache_firmware and uncache_firmware Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 08/15] firmware loader: fix device lifetime Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 09/15] firmware loader: fix comments on request_firmware_nowait Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 10/15] firmware loader: store firmware name into devres list Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 11/15] driver core: devres: introduce devres_for_each_res Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 12/15] firmware: introduce device_cache/uncache_fw_images Ming Lei
2012-09-06 22:44 ` Andrew Morton
2012-09-07 3:32 ` Ming Lei
2012-09-07 15:16 ` Greg Kroah-Hartman
2012-09-08 9:34 ` Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 13/15] firmware loader: use small timeout for cache device firmware Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 14/15] firmware loader: cache devices firmware during suspend/resume cycle Ming Lei
2012-08-04 4:01 ` [RFC PATCH v1 15/15] wireless: ath9k-htc: only load firmware in need Ming Lei
2012-08-10 7:30 ` [RFC PATCH v1 00/15] firmware loader: introduce cache/uncache firmware Ming Lei
2012-08-16 20:46 ` Greg Kroah-Hartman
2012-08-17 0:04 ` Ming Lei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1344052890-31935-3-git-send-email-ming.lei@canonical.com \
--to=ming.lei@canonical.com \
--cc=borislav.petkov@amd.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rjw@sisk.pl \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).