Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1762005AbdLSKna (ORCPT ); Tue, 19 Dec 2017 05:43:30 -0500 Received: from mx08-00178001.pphosted.com ([91.207.212.93]:47787 "EHLO mx07-00178001.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1758943AbdLSKn2 (ORCPT ); Tue, 19 Dec 2017 05:43:28 -0500 From: Fabien DESSENNE To: Jia-Ju Bai , "hverkuil@xs4all.nl" , Benjamin GAIGNARD , "mchehab@kernel.org" CC: "linux-media@vger.kernel.org" , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH V2 1/2] bdisp: Fix a possible sleep-in-atomic bug in bdisp_hw_reset Thread-Topic: [PATCH V2 1/2] bdisp: Fix a possible sleep-in-atomic bug in bdisp_hw_reset Thread-Index: AQHTdmRAOYoNdfRqHEycBS4bT6tAVKNKbtUA Date: Tue, 19 Dec 2017 10:43:22 +0000 Message-ID: References: <1513425251-4143-1-git-send-email-baijiaju1990@gmail.com> In-Reply-To: <1513425251-4143-1-git-send-email-baijiaju1990@gmail.com> Accept-Language: fr-FR, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.75.127.45] Content-Type: text/plain; charset="utf-8" Content-ID: MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-12-19_06:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by nfs id vBJAhZrr031168 Content-Length: 2003 Lines: 74 Hi, On 16/12/17 12:54, Jia-Ju Bai wrote: > The driver may sleep under a spinlock. > The function call path is: > bdisp_device_run (acquire the spinlock) > bdisp_hw_reset > msleep --> may sleep > > To fix it, readl_poll_timeout_atomic is used to replace msleep. > > This bug is found by my static analysis tool(DSAC) and > checked by my code review. > > Signed-off-by: Jia-Ju Bai > --- > drivers/media/platform/sti/bdisp/bdisp-hw.c | 16 ++++++++-------- > 1 file changed, 8 insertions(+), 8 deletions(-) > > diff --git a/drivers/media/platform/sti/bdisp/bdisp-hw.c b/drivers/media/platform/sti/bdisp/bdisp-hw.c > index b7892f3..e94a371 100644 > --- a/drivers/media/platform/sti/bdisp/bdisp-hw.c > +++ b/drivers/media/platform/sti/bdisp/bdisp-hw.c > @@ -5,6 +5,7 @@ > */ > > #include This delay.h include is no more needed, remove it. > +#include > > #include "bdisp.h" > #include "bdisp-filter.h" > @@ -366,7 +367,7 @@ struct bdisp_filter_addr { > */ > int bdisp_hw_reset(struct bdisp_dev *bdisp) > { > - unsigned int i; > + u32 tmp; > > dev_dbg(bdisp->dev, "%s\n", __func__); > > @@ -379,15 +380,14 @@ int bdisp_hw_reset(struct bdisp_dev *bdisp) > writel(0, bdisp->regs + BLT_CTL); > > /* Wait for reset done */ > - for (i = 0; i < POLL_RST_MAX; i++) { > - if (readl(bdisp->regs + BLT_STA1) & BLT_STA1_IDLE) > - break; > - msleep(POLL_RST_DELAY_MS); > - } > - if (i == POLL_RST_MAX) As recommended by Mauro, please add this comment: Despite the large timeout, most of the time the reset happens without needing any delays > + if (readl_poll_timeout_atomic(bdisp->regs + BLT_STA1, tmp, > + (tmp & BLT_STA1_IDLE), POLL_RST_DELAY_MS, > + POLL_RST_DELAY_MS * POLL_RST_MAX)) { read_poll_timeout expects US timings, not MS. > dev_err(bdisp->dev, "Reset timeout\n"); > + return -EAGAIN; > + } > > - return (i == POLL_RST_MAX) ? -EAGAIN : 0; > + return 0; > } > > /**