From d9d233d9da081d2584fb4eb651a316565f5c498f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 24 Mar 2024 17:49:50 +0100 Subject: [PATCH] 4.19-stable patches added patches: comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch --- ...-timers-rescheduling-during-deletion.patch | 123 ++++++++++++++++++ queue-4.19/series | 1 + 2 files changed, 124 insertions(+) create mode 100644 queue-4.19/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch diff --git a/queue-4.19/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch b/queue-4.19/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch new file mode 100644 index 00000000000..163f064c81e --- /dev/null +++ b/queue-4.19/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch @@ -0,0 +1,123 @@ +From f53641a6e849034a44bf80f50245a75d7a376025 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 14 Feb 2024 10:07:25 +0000 +Subject: comedi: comedi_test: Prevent timers rescheduling during deletion + +From: Ian Abbott + +commit f53641a6e849034a44bf80f50245a75d7a376025 upstream. + +The comedi_test devices have a couple of timers (ai_timer and ao_timer) +that can be started to simulate hardware interrupts. Their expiry +functions normally reschedule the timer. The driver code calls either +del_timer_sync() or del_timer() to delete the timers from the queue, but +does not currently prevent the timers from rescheduling themselves so +synchronized deletion may be ineffective. + +Add a couple of boolean members (one for each timer: ai_timer_enable and +ao_timer_enable) to the device private data structure to indicate +whether the timers are allowed to reschedule themselves. Set the member +to true when adding the timer to the queue, and to false when deleting +the timer from the queue in the waveform_ai_cancel() and +waveform_ao_cancel() functions. + +The del_timer_sync() function is also called from the waveform_detach() +function, but the timer enable members will already be set to false when +that function is called, so no change is needed there. + +Fixes: 403fe7f34e33 ("staging: comedi: comedi_test: fix timer race conditions") +Cc: stable@vger.kernel.org # 4.4+ +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20240214100747.16203-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/comedi/drivers/comedi_test.c | 30 +++++++++++++++++++++++---- + 1 file changed, 26 insertions(+), 4 deletions(-) + +--- a/drivers/staging/comedi/drivers/comedi_test.c ++++ b/drivers/staging/comedi/drivers/comedi_test.c +@@ -87,6 +87,8 @@ struct waveform_private { + struct comedi_device *dev; /* parent comedi device */ + u64 ao_last_scan_time; /* time of previous AO scan in usec */ + unsigned int ao_scan_period; /* AO scan period in usec */ ++ bool ai_timer_enable:1; /* should AI timer be running? */ ++ bool ao_timer_enable:1; /* should AO timer be running? */ + unsigned short ao_loopbacks[N_CHANS]; + }; + +@@ -236,8 +238,12 @@ static void waveform_ai_timer(struct tim + time_increment = devpriv->ai_convert_time - now; + else + time_increment = 1; +- mod_timer(&devpriv->ai_timer, +- jiffies + usecs_to_jiffies(time_increment)); ++ spin_lock(&dev->spinlock); ++ if (devpriv->ai_timer_enable) { ++ mod_timer(&devpriv->ai_timer, ++ jiffies + usecs_to_jiffies(time_increment)); ++ } ++ spin_unlock(&dev->spinlock); + } + + overrun: +@@ -393,9 +399,12 @@ static int waveform_ai_cmd(struct comedi + * Seem to need an extra jiffy here, otherwise timer expires slightly + * early! + */ ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ai_timer_enable = true; + devpriv->ai_timer.expires = + jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1; + add_timer(&devpriv->ai_timer); ++ spin_unlock_bh(&dev->spinlock); + return 0; + } + +@@ -404,6 +413,9 @@ static int waveform_ai_cancel(struct com + { + struct waveform_private *devpriv = dev->private; + ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ai_timer_enable = false; ++ spin_unlock_bh(&dev->spinlock); + if (in_softirq()) { + /* Assume we were called from the timer routine itself. */ + del_timer(&devpriv->ai_timer); +@@ -495,8 +507,12 @@ static void waveform_ao_timer(struct tim + unsigned int time_inc = devpriv->ao_last_scan_time + + devpriv->ao_scan_period - now; + +- mod_timer(&devpriv->ao_timer, +- jiffies + usecs_to_jiffies(time_inc)); ++ spin_lock(&dev->spinlock); ++ if (devpriv->ao_timer_enable) { ++ mod_timer(&devpriv->ao_timer, ++ jiffies + usecs_to_jiffies(time_inc)); ++ } ++ spin_unlock(&dev->spinlock); + } + + underrun: +@@ -517,9 +533,12 @@ static int waveform_ao_inttrig_start(str + async->inttrig = NULL; + + devpriv->ao_last_scan_time = ktime_to_us(ktime_get()); ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ao_timer_enable = true; + devpriv->ao_timer.expires = + jiffies + usecs_to_jiffies(devpriv->ao_scan_period); + add_timer(&devpriv->ao_timer); ++ spin_unlock_bh(&dev->spinlock); + + return 1; + } +@@ -604,6 +623,9 @@ static int waveform_ao_cancel(struct com + struct waveform_private *devpriv = dev->private; + + s->async->inttrig = NULL; ++ spin_lock_bh(&dev->spinlock); ++ devpriv->ao_timer_enable = false; ++ spin_unlock_bh(&dev->spinlock); + if (in_softirq()) { + /* Assume we were called from the timer routine itself. */ + del_timer(&devpriv->ao_timer); diff --git a/queue-4.19/series b/queue-4.19/series index 1451d833d77..4d142f70c60 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -131,3 +131,4 @@ scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch nfs-fix-an-off-by-one-in-root_nfs_cat.patch clk-qcom-gdsc-add-support-to-update-gdsc-transition-.patch +comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch -- 2.47.2