From: Greg Kroah-Hartman Date: Sun, 24 Mar 2024 16:50:44 +0000 (+0100) Subject: 6.1-stable patches X-Git-Tag: v6.8.2~73 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e9bcbeca9546ba81778b163e44cf14a0d56bb294;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch --- diff --git a/queue-6.1/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch b/queue-6.1/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch new file mode 100644 index 00000000000..2f193f7a2e6 --- /dev/null +++ b/queue-6.1/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch @@ -0,0 +1,123 @@ +From f53641a6e849034a44bf80f50245a75d7a376025 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 14 Feb 2024 10:07:25 +0000 +Subject: comedi: comedi_test: Prevent timers rescheduling during deletion + +From: Ian Abbott + +commit f53641a6e849034a44bf80f50245a75d7a376025 upstream. + +The comedi_test devices have a couple of timers (ai_timer and ao_timer) +that can be started to simulate hardware interrupts. Their expiry +functions normally reschedule the timer. The driver code calls either +del_timer_sync() or del_timer() to delete the timers from the queue, but +does not currently prevent the timers from rescheduling themselves so +synchronized deletion may be ineffective. + +Add a couple of boolean members (one for each timer: ai_timer_enable and +ao_timer_enable) to the device private data structure to indicate +whether the timers are allowed to reschedule themselves. Set the member +to true when adding the timer to the queue, and to false when deleting +the timer from the queue in the waveform_ai_cancel() and +waveform_ao_cancel() functions. + +The del_timer_sync() function is also called from the waveform_detach() +function, but the timer enable members will already be set to false when +that function is called, so no change is needed there. + +Fixes: 403fe7f34e33 ("staging: comedi: comedi_test: fix timer race conditions") +Cc: stable@vger.kernel.org # 4.4+ +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20240214100747.16203-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/comedi/drivers/comedi_test.c | 30 ++++++++++++++++++++++++++---- + 1 file changed, 26 insertions(+), 4 deletions(-) + +--- a/drivers/comedi/drivers/comedi_test.c ++++ b/drivers/comedi/drivers/comedi_test.c +@@ -85,6 +85,8 @@ struct waveform_private { + struct comedi_device *dev; /* parent comedi device */ + u64 ao_last_scan_time; /* time of previous AO scan in usec */ + unsigned int ao_scan_period; /* AO scan period in usec */ ++ bool ai_timer_enable:1; /* should AI timer be running? */ ++ bool ao_timer_enable:1; /* should AO timer be running? */ + unsigned short ao_loopbacks[N_CHANS]; + }; + +@@ -234,8 +236,12 @@ static void waveform_ai_timer(struct tim + time_increment = devpriv->ai_convert_time - now; + else + time_increment = 1; +- mod_timer(&devpriv->ai_timer, +- jiffies + usecs_to_jiffies(time_increment)); ++ spin_lock(&dev->spinlock); ++ if (devpriv->ai_timer_enable) { ++ mod_timer(&devpriv->ai_timer, ++ jiffies + usecs_to_jiffies(time_increment)); ++ } ++ spin_unlock(&dev->spinlock); + } + + overrun: +@@ -391,9 +397,12 @@ static int waveform_ai_cmd(struct comedi + * Seem to need an extra jiffy here, otherwise timer expires slightly + * early! + */ ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ai_timer_enable = true; + devpriv->ai_timer.expires = + jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1; + add_timer(&devpriv->ai_timer); ++ spin_unlock_bh(&dev->spinlock); + return 0; + } + +@@ -402,6 +411,9 @@ static int waveform_ai_cancel(struct com + { + struct waveform_private *devpriv = dev->private; + ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ai_timer_enable = false; ++ spin_unlock_bh(&dev->spinlock); + if (in_softirq()) { + /* Assume we were called from the timer routine itself. */ + del_timer(&devpriv->ai_timer); +@@ -493,8 +505,12 @@ static void waveform_ao_timer(struct tim + unsigned int time_inc = devpriv->ao_last_scan_time + + devpriv->ao_scan_period - now; + +- mod_timer(&devpriv->ao_timer, +- jiffies + usecs_to_jiffies(time_inc)); ++ spin_lock(&dev->spinlock); ++ if (devpriv->ao_timer_enable) { ++ mod_timer(&devpriv->ao_timer, ++ jiffies + usecs_to_jiffies(time_inc)); ++ } ++ spin_unlock(&dev->spinlock); + } + + underrun: +@@ -515,9 +531,12 @@ static int waveform_ao_inttrig_start(str + async->inttrig = NULL; + + devpriv->ao_last_scan_time = ktime_to_us(ktime_get()); ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ao_timer_enable = true; + devpriv->ao_timer.expires = + jiffies + usecs_to_jiffies(devpriv->ao_scan_period); + add_timer(&devpriv->ao_timer); ++ spin_unlock_bh(&dev->spinlock); + + return 1; + } +@@ -602,6 +621,9 @@ static int waveform_ao_cancel(struct com + struct waveform_private *devpriv = dev->private; + + s->async->inttrig = NULL; ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ao_timer_enable = false; ++ spin_unlock_bh(&dev->spinlock); + if (in_softirq()) { + /* Assume we were called from the timer routine itself. */ + del_timer(&devpriv->ao_timer); diff --git a/queue-6.1/series b/queue-6.1/series index 68d98395b84..c29b960b640 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -395,3 +395,4 @@ perf-x86-amd-core-avoid-register-reset-when-cpu-is-d.patch afs-revert-afs-hide-silly-rename-files-from-userspac.patch nfs-fix-panic-when-nfs4_ff_layout_prepare_ds-fails.patch io_uring-net-correct-the-type-of-variable.patch +comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch