• Du, Changbin's avatar
    usb: f_fs: avoid race condition with ffs_epfile_io_complete · ef150884
    Du, Changbin authored
    ffs_epfile_io and ffs_epfile_io_complete runs in different context, but
    there is no synchronization between them.
    
    consider the following scenario:
    1) ffs_epfile_io interrupted by sigal while
    wait_for_completion_interruptible
    2) then ffs_epfile_io set ret to -EINTR
    3) just before or during usb_ep_dequeue, the request completed
    4) ffs_epfile_io return with -EINTR
    
    In this case, ffs_epfile_io tell caller no transfer success but actually
    it may has been done. This break the caller's pipe.
    
    Below script can help test it (adbd is the process which lies on f_fs).
    while true
    do
       pkill -19 adbd #SIGSTOP
       pkill -18 adbd #SIGCONT
       sleep 0.1
    done
    
    To avoid this, just dequeue the request first. After usb_ep_dequeue, the
    request must be done or canceled.
    
    With this change, we can ensure no race condition in f_fs driver. But
    actually I found some of the udc driver has analogical issue in its
    dequeue implementation. For example,
    1) the dequeue function hold the controller's lock.
    2) before driver request controller  to stop transfer, a request
       completed.
    3) the controller trigger a interrupt, but its irq handler need wait
       dequeue function to release the lock.
    4) dequeue function give back the request with negative status, and
       release lock.
    5) irq handler get lock but the request has already been given back.
    
    So, the dequeue implementation should take care of this case. IMO, it
    can be done as below steps to dequeue a already started request,
    1) request controller to stop transfer on the given ep. HW know the
       actual transfer status.
    2) after hw stop transfer, driver scan if there are any completed one.
    3) if found, process it with real status. if no, the request can
       canceled.
    Signed-off-by: default avatar"Du, Changbin" <changbin.du@intel.com>
    [mina86@mina86.com: rebased on top of refactoring commits]
    Signed-off-by: default avatarMichal Nazarewicz <mina86@mina86.com>
    Signed-off-by: default avatarFelipe Balbi <balbi@kernel.org>
    ef150884
f_fs.c 79.3 KB