[patch] drivers/block/floppy.c: dont free_irq() from irq context

[patch] drivers/block/floppy.c: dont free_irq() from irq context

[Ingo Molnar]

free_irq() should not be executed from softirq context.

Found by the lock validator:

  ============================
  [ BUG: illegal lock usage! ]
  ----------------------------
  illegal {enabled-softirqs} -> {used-in-softirq} usage.
  rcu_torture_rea/265 [HC0[0]:SC1[2]:HE1:SE0] takes:
   {proc_subdir_lock} [<c0198163>] remove_proc_entry+0x33/0x1f0
  {enabled-softirqs} state was registered at:
   [<c0122c09>] irq_exit+0x39/0x50
  hardirqs last enabled at: [<c04da025>] _spin_unlock_irqrestore+0x25/0x30
  softirqs last enabled at: [<c0122c09>] irq_exit+0x39/0x50
  
  other info that might help us debug this:
  locks held by rcu_torture_rea/265:
  
  stack backtrace:
   [<c010432d>] show_trace+0xd/0x10
   [<c0104347>] dump_stack+0x17/0x20
   [<c01380f4>] print_usage_bug+0x1c4/0x1e0
   [<c0138971>] mark_lock+0x221/0x2c0
   [<c0138cc2>] debug_lock_chain+0x2b2/0xd40
   [<c013978d>] debug_lock_chain_spin+0x3d/0x60
   [<c0266a1d>] _raw_spin_lock+0x2d/0x90
   [<c04d9e88>] _spin_lock+0x8/0x10
   [<c0198163>] remove_proc_entry+0x33/0x1f0
   [<c0142ca9>] unregister_handler_proc+0x19/0x20
   [<c014246b>] free_irq+0x7b/0xe0
   [<c02f3632>] floppy_release_irq_and_dma+0x1b2/0x210
   [<c02f1b27>] set_dor+0xc7/0x1b0
   [<c02f4ba1>] motor_off_callback+0x21/0x30
   [<c0127605>] run_timer_softirq+0xf5/0x1f0
   [<c0122f57>] __do_softirq+0x97/0x130
   [<c0105519>] do_softirq+0x69/0x100
   =======================

the fix is to push fd_free_irq() into keventd. The code validates fine 
with this patch applied.

Signed-off-by: Ingo Molnar <mingo@elte.hu>

----

Index: linux/drivers/block/floppy.c
===================================================================
--- linux.orig/drivers/block/floppy.c
+++ linux/drivers/block/floppy.c
@@ -251,6 +251,18 @@ static int irqdma_allocated;
 #include <linux/cdrom.h>	/* for the compatibility eject ioctl */
 #include <linux/completion.h>
 
+/*
+ * Interrupt freeing also means /proc VFS work - dont do it
+ * from interrupt context. We push this work into keventd:
+ */
+static void fd_free_irq_fn(void *data)
+{
+	fd_free_irq();
+}
+
+static DECLARE_WORK(fd_free_irq_work, fd_free_irq_fn, NULL);
+
+
 static struct request *current_req;
 static struct request_queue *floppy_queue;
 static void do_fd_request(request_queue_t * q);
@@ -4434,6 +4446,13 @@ static int floppy_grab_irq_and_dma(void)
 		return 0;
 	}
 	spin_unlock_irqrestore(&floppy_usage_lock, flags);
+
+	/*
+	 * We might have scheduled a free_irq(), wait it to
+	 * drain first:
+	 */
+	flush_scheduled_work();
+
 	if (fd_request_irq()) {
 		DPRINT("Unable to grab IRQ%d for the floppy driver\n",
 		       FLOPPY_IRQ);
@@ -4523,7 +4542,7 @@ static void floppy_release_irq_and_dma(v
 	if (irqdma_allocated) {
 		fd_disable_dma();
 		fd_free_dma();
-		fd_free_irq();
+		schedule_work(&fd_free_irq_work);
 		irqdma_allocated = 0;
 	}
 	set_dor(0, ~0, 8);

Re: [patch] drivers/block/floppy.c: dont free_irq() from irq context

[Andrew Morton]

Ingo Molnar <mingo@elte.hu> wrote:
>
> free_irq() should not be executed from softirq context.
> 
> ...
> 
> the fix is to push fd_free_irq() into keventd. The code validates fine 
> with this patch applied.
> 
> --- linux.orig/drivers/block/floppy.c
> +++ linux/drivers/block/floppy.c

You know this makes you the floppy maintainer?

> @@ -251,6 +251,18 @@ static int irqdma_allocated;
>  #include <linux/cdrom.h>	/* for the compatibility eject ioctl */
>  #include <linux/completion.h>
>  
> +/*
> + * Interrupt freeing also means /proc VFS work - dont do it
> + * from interrupt context. We push this work into keventd:
> + */
> +static void fd_free_irq_fn(void *data)
> +{
> +	fd_free_irq();
> +}
> +
> +static DECLARE_WORK(fd_free_irq_work, fd_free_irq_fn, NULL);
> +
> +
>  static struct request *current_req;
>  static struct request_queue *floppy_queue;
>  static void do_fd_request(request_queue_t * q);
> @@ -4434,6 +4446,13 @@ static int floppy_grab_irq_and_dma(void)
>  		return 0;
>  	}
>  	spin_unlock_irqrestore(&floppy_usage_lock, flags);
> +
> +	/*
> +	 * We might have scheduled a free_irq(), wait it to
> +	 * drain first:
> +	 */
> +	flush_scheduled_work();
> +

yup.

>  	if (fd_request_irq()) {
>  		DPRINT("Unable to grab IRQ%d for the floppy driver\n",
>  		       FLOPPY_IRQ);
> @@ -4523,7 +4542,7 @@ static void floppy_release_irq_and_dma(v
>  	if (irqdma_allocated) {
>  		fd_disable_dma();
>  		fd_free_dma();
> -		fd_free_irq();
> +		schedule_work(&fd_free_irq_work);
>  		irqdma_allocated = 0;
>  	}
>  	set_dor(0, ~0, 8);

I think we need a flush_scheduled_work() in cleanup_module() too.  Because
floppy_release_irq_and_dma() might have taken usage_count to zero, but the
workqueue is still pending.

This patch doesn't do anything to improve the floppy driver :(