From: Greg Kroah-Hartman Date: Wed, 27 Mar 2024 13:47:05 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v6.7.12~215 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=88d8bd2f3344bb26582f190f74869fb566e7f3ff;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch --- diff --git a/queue-5.4/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch b/queue-5.4/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch new file mode 100644 index 00000000000..163f064c81e --- /dev/null +++ b/queue-5.4/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch @@ -0,0 +1,123 @@ +From f53641a6e849034a44bf80f50245a75d7a376025 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 14 Feb 2024 10:07:25 +0000 +Subject: comedi: comedi_test: Prevent timers rescheduling during deletion + +From: Ian Abbott + +commit f53641a6e849034a44bf80f50245a75d7a376025 upstream. + +The comedi_test devices have a couple of timers (ai_timer and ao_timer) +that can be started to simulate hardware interrupts. Their expiry +functions normally reschedule the timer. The driver code calls either +del_timer_sync() or del_timer() to delete the timers from the queue, but +does not currently prevent the timers from rescheduling themselves so +synchronized deletion may be ineffective. + +Add a couple of boolean members (one for each timer: ai_timer_enable and +ao_timer_enable) to the device private data structure to indicate +whether the timers are allowed to reschedule themselves. Set the member +to true when adding the timer to the queue, and to false when deleting +the timer from the queue in the waveform_ai_cancel() and +waveform_ao_cancel() functions. + +The del_timer_sync() function is also called from the waveform_detach() +function, but the timer enable members will already be set to false when +that function is called, so no change is needed there. + +Fixes: 403fe7f34e33 ("staging: comedi: comedi_test: fix timer race conditions") +Cc: stable@vger.kernel.org # 4.4+ +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20240214100747.16203-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/comedi/drivers/comedi_test.c | 30 +++++++++++++++++++++++---- + 1 file changed, 26 insertions(+), 4 deletions(-) + +--- a/drivers/staging/comedi/drivers/comedi_test.c ++++ b/drivers/staging/comedi/drivers/comedi_test.c +@@ -87,6 +87,8 @@ struct waveform_private { + struct comedi_device *dev; /* parent comedi device */ + u64 ao_last_scan_time; /* time of previous AO scan in usec */ + unsigned int ao_scan_period; /* AO scan period in usec */ ++ bool ai_timer_enable:1; /* should AI timer be running? */ ++ bool ao_timer_enable:1; /* should AO timer be running? */ + unsigned short ao_loopbacks[N_CHANS]; + }; + +@@ -236,8 +238,12 @@ static void waveform_ai_timer(struct tim + time_increment = devpriv->ai_convert_time - now; + else + time_increment = 1; +- mod_timer(&devpriv->ai_timer, +- jiffies + usecs_to_jiffies(time_increment)); ++ spin_lock(&dev->spinlock); ++ if (devpriv->ai_timer_enable) { ++ mod_timer(&devpriv->ai_timer, ++ jiffies + usecs_to_jiffies(time_increment)); ++ } ++ spin_unlock(&dev->spinlock); + } + + overrun: +@@ -393,9 +399,12 @@ static int waveform_ai_cmd(struct comedi + * Seem to need an extra jiffy here, otherwise timer expires slightly + * early! + */ ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ai_timer_enable = true; + devpriv->ai_timer.expires = + jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1; + add_timer(&devpriv->ai_timer); ++ spin_unlock_bh(&dev->spinlock); + return 0; + } + +@@ -404,6 +413,9 @@ static int waveform_ai_cancel(struct com + { + struct waveform_private *devpriv = dev->private; + ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ai_timer_enable = false; ++ spin_unlock_bh(&dev->spinlock); + if (in_softirq()) { + /* Assume we were called from the timer routine itself. */ + del_timer(&devpriv->ai_timer); +@@ -495,8 +507,12 @@ static void waveform_ao_timer(struct tim + unsigned int time_inc = devpriv->ao_last_scan_time + + devpriv->ao_scan_period - now; + +- mod_timer(&devpriv->ao_timer, +- jiffies + usecs_to_jiffies(time_inc)); ++ spin_lock(&dev->spinlock); ++ if (devpriv->ao_timer_enable) { ++ mod_timer(&devpriv->ao_timer, ++ jiffies + usecs_to_jiffies(time_inc)); ++ } ++ spin_unlock(&dev->spinlock); + } + + underrun: +@@ -517,9 +533,12 @@ static int waveform_ao_inttrig_start(str + async->inttrig = NULL; + + devpriv->ao_last_scan_time = ktime_to_us(ktime_get()); ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ao_timer_enable = true; + devpriv->ao_timer.expires = + jiffies + usecs_to_jiffies(devpriv->ao_scan_period); + add_timer(&devpriv->ao_timer); ++ spin_unlock_bh(&dev->spinlock); + + return 1; + } +@@ -604,6 +623,9 @@ static int waveform_ao_cancel(struct com + struct waveform_private *devpriv = dev->private; + + s->async->inttrig = NULL; ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ao_timer_enable = false; ++ spin_unlock_bh(&dev->spinlock); + if (in_softirq()) { + /* Assume we were called from the timer routine itself. */ + del_timer(&devpriv->ao_timer); diff --git a/queue-5.4/series b/queue-5.4/series index 4b0260389f6..d0b0fbe63b7 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -77,3 +77,4 @@ x86-cpu-amd-update-the-zenbleed-microcode-revisions.patch ahci-asm1064-correct-count-of-reported-ports.patch ahci-asm1064-asm1166-don-t-limit-reported-ports.patch dm-snapshot-fix-lockup-in-dm_exception_table_exit.patch +comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch