2022-04-07 17:58:21

by Duoming Zhou

Subject: [PATCH V2 11/11] arch: xtensa: platforms: Fix deadlock in rs_close()

There is a deadlock in rs_close(), which is shown
below:

(Thread 1) | (Thread 2)
| rs_open()
rs_close() | mod_timer()
spin_lock_bh() //(1) | (wait a time)
... | rs_poll()
del_timer_sync() | spin_lock() //(2)
(wait timer to stop) | ...

We hold timer_lock in position (1) of thread 1 and
use del_timer_sync() to wait timer to stop, but timer handler
also need timer_lock in position (2) of thread 2.
As a result, rs_close() will block forever.

This patch deletes the redundant timer_lock in order to
prevent the deadlock. Because there is no race condition
between rs_close, rs_open and rs_poll.

Signed-off-by: Duoming Zhou <[email protected]>
---
Changes in V2:
- Remove the timer_lock.

arch/xtensa/platforms/iss/console.c | 8 --------
1 file changed, 8 deletions(-)

diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c
index 81d7c7e8f7e..10b79d3c74e 100644
--- a/arch/xtensa/platforms/iss/console.c
+++ b/arch/xtensa/platforms/iss/console.c
@@ -36,24 +36,19 @@ static void rs_poll(struct timer_list *);
static struct tty_driver *serial_driver;
static struct tty_port serial_port;
static DEFINE_TIMER(serial_timer, rs_poll);
-static DEFINE_SPINLOCK(timer_lock);

static int rs_open(struct tty_struct *tty, struct file * filp)
{
- spin_lock_bh(&timer_lock);
if (tty->count == 1)
mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE);
- spin_unlock_bh(&timer_lock);

return 0;
}

static void rs_close(struct tty_struct *tty, struct file * filp)
{
- spin_lock_bh(&timer_lock);
if (tty->count == 1)
del_timer_sync(&serial_timer);
- spin_unlock_bh(&timer_lock);
}


@@ -73,8 +68,6 @@ static void rs_poll(struct timer_list *unused)
int rd = 1;
unsigned char c;

- spin_lock(&timer_lock);
-
while (simc_poll(0)) {
rd = simc_read(0, &c, 1);
if (rd <= 0)
@@ -87,7 +80,6 @@ static void rs_poll(struct timer_list *unused)
tty_flip_buffer_push(port);
if (rd)
mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE);
- spin_unlock(&timer_lock);
}


--
2.17.1

2022-04-07 22:38:37

by Max Filippov

Subject: Re: [PATCH V2 11/11] arch: xtensa: platforms: Fix deadlock in rs_close()

On Thu, Apr 7, 2022 at 8:44 AM Duoming Zhou <[email protected]> wrote:
>
> There is a deadlock in rs_close(), which is shown
> below:
>
> (Thread 1) | (Thread 2)
> | rs_open()
> rs_close() | mod_timer()
> spin_lock_bh() //(1) | (wait a time)
> ... | rs_poll()
> del_timer_sync() | spin_lock() //(2)
> (wait timer to stop) | ...
>
> We hold timer_lock in position (1) of thread 1 and
> use del_timer_sync() to wait timer to stop, but timer handler
> also need timer_lock in position (2) of thread 2.
> As a result, rs_close() will block forever.
>
> This patch deletes the redundant timer_lock in order to
> prevent the deadlock. Because there is no race condition
> between rs_close, rs_open and rs_poll.
>
> Signed-off-by: Duoming Zhou <[email protected]>
> ---
> Changes in V2:
> - Remove the timer_lock.
>
> arch/xtensa/platforms/iss/console.c | 8 --------
> 1 file changed, 8 deletions(-)

Thanks. Applied to my xtensa tree.

-- Max