From: Greg Kroah-Hartman Date: Sun, 24 Mar 2024 16:50:19 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.8.2~75 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0f4981b79f3f9d94739924a08581027270ab0250;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch --- diff --git a/queue-5.10/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch b/queue-5.10/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch new file mode 100644 index 00000000000..e542ec65f61 --- /dev/null +++ b/queue-5.10/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch @@ -0,0 +1,128 @@ +From f53641a6e849034a44bf80f50245a75d7a376025 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 14 Feb 2024 10:07:25 +0000 +Subject: comedi: comedi_test: Prevent timers rescheduling during deletion + +From: Ian Abbott + +commit f53641a6e849034a44bf80f50245a75d7a376025 upstream. + +The comedi_test devices have a couple of timers (ai_timer and ao_timer) +that can be started to simulate hardware interrupts. Their expiry +functions normally reschedule the timer. The driver code calls either +del_timer_sync() or del_timer() to delete the timers from the queue, but +does not currently prevent the timers from rescheduling themselves so +synchronized deletion may be ineffective. + +Add a couple of boolean members (one for each timer: ai_timer_enable and +ao_timer_enable) to the device private data structure to indicate +whether the timers are allowed to reschedule themselves. Set the member +to true when adding the timer to the queue, and to false when deleting +the timer from the queue in the waveform_ai_cancel() and +waveform_ao_cancel() functions. + +The del_timer_sync() function is also called from the waveform_detach() +function, but the timer enable members will already be set to false when +that function is called, so no change is needed there. + +Fixes: 403fe7f34e33 ("staging: comedi: comedi_test: fix timer race conditions") +Cc: stable@vger.kernel.org # 4.4+ +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20240214100747.16203-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/comedi/drivers/comedi_test.c | 30 ++++++++++++++++++++++++---- + 1 file changed, 26 insertions(+), 4 deletions(-) + +diff --git a/drivers/comedi/drivers/comedi_test.c b/drivers/comedi/drivers/comedi_test.c +index 30ea8b53ebf8..05ae9122823f 100644 +--- a/drivers/comedi/drivers/comedi_test.c ++++ b/drivers/comedi/drivers/comedi_test.c +@@ -87,6 +87,8 @@ struct waveform_private { + struct comedi_device *dev; /* parent comedi device */ + u64 ao_last_scan_time; /* time of previous AO scan in usec */ + unsigned int ao_scan_period; /* AO scan period in usec */ ++ bool ai_timer_enable:1; /* should AI timer be running? */ ++ bool ao_timer_enable:1; /* should AO timer be running? */ + unsigned short ao_loopbacks[N_CHANS]; + }; + +@@ -236,8 +238,12 @@ static void waveform_ai_timer(struct timer_list *t) + time_increment = devpriv->ai_convert_time - now; + else + time_increment = 1; +- mod_timer(&devpriv->ai_timer, +- jiffies + usecs_to_jiffies(time_increment)); ++ spin_lock(&dev->spinlock); ++ if (devpriv->ai_timer_enable) { ++ mod_timer(&devpriv->ai_timer, ++ jiffies + usecs_to_jiffies(time_increment)); ++ } ++ spin_unlock(&dev->spinlock); + } + + overrun: +@@ -393,9 +399,12 @@ static int waveform_ai_cmd(struct comedi_device *dev, + * Seem to need an extra jiffy here, otherwise timer expires slightly + * early! + */ ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ai_timer_enable = true; + devpriv->ai_timer.expires = + jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1; + add_timer(&devpriv->ai_timer); ++ spin_unlock_bh(&dev->spinlock); + return 0; + } + +@@ -404,6 +413,9 @@ static int waveform_ai_cancel(struct comedi_device *dev, + { + struct waveform_private *devpriv = dev->private; + ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ai_timer_enable = false; ++ spin_unlock_bh(&dev->spinlock); + if (in_softirq()) { + /* Assume we were called from the timer routine itself. */ + del_timer(&devpriv->ai_timer); +@@ -495,8 +507,12 @@ static void waveform_ao_timer(struct timer_list *t) + unsigned int time_inc = devpriv->ao_last_scan_time + + devpriv->ao_scan_period - now; + +- mod_timer(&devpriv->ao_timer, +- jiffies + usecs_to_jiffies(time_inc)); ++ spin_lock(&dev->spinlock); ++ if (devpriv->ao_timer_enable) { ++ mod_timer(&devpriv->ao_timer, ++ jiffies + usecs_to_jiffies(time_inc)); ++ } ++ spin_unlock(&dev->spinlock); + } + + underrun: +@@ -517,9 +533,12 @@ static int waveform_ao_inttrig_start(struct comedi_device *dev, + async->inttrig = NULL; + + devpriv->ao_last_scan_time = ktime_to_us(ktime_get()); ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ao_timer_enable = true; + devpriv->ao_timer.expires = + jiffies + usecs_to_jiffies(devpriv->ao_scan_period); + add_timer(&devpriv->ao_timer); ++ spin_unlock_bh(&dev->spinlock); + + return 1; + } +@@ -604,6 +623,9 @@ static int waveform_ao_cancel(struct comedi_device *dev, + struct waveform_private *devpriv = dev->private; + + s->async->inttrig = NULL; ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ao_timer_enable = false; ++ spin_unlock_bh(&dev->spinlock); + if (in_softirq()) { + /* Assume we were called from the timer routine itself. */ + del_timer(&devpriv->ao_timer); +-- +2.44.0 + diff --git a/queue-5.10/series b/queue-5.10/series index 2fd8b4b9eef..3a6d60497c6 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -204,3 +204,4 @@ nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch watchdog-stm32_iwdg-initialize-default-timeout.patch nfs-fix-an-off-by-one-in-root_nfs_cat.patch afs-revert-afs-hide-silly-rename-files-from-userspac.patch +comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch