From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9378A3C7E19 for ; Wed, 17 Jun 2026 10:28:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781692129; cv=none; b=ENKgp3PbHEKP6sRqb3XWFZhhV2pNKiDpA1PAUdE/h4FJpNux+oJxMfj9cUlvTgpqpA3h5f4eyneCq07IVsFaNxSd+ist26lU2t+NdM5H2iGbMWoT/HVp+gSqYB1xt+abqW4HHcViwsvzdvSfcUCgyOf3TPT1EjU4cRwQyiG/34o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781692129; c=relaxed/simple; bh=vykhn2iUP9xzlyVXNGgjtbmpfhnAgLGYRybi/3hncsM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=sK8cPUzjIyqw1VtrfrP+9pF5tgXsHg6rcdOjk85OZqvjD6eaLYEFKhX0RupctqIB8wMWG3jKgpEJV9G2ScIvXEGCiaZtFwk5h1jWdhBq/UKehn+MqGlBqxvatqfAbK0vKrtQK8pe8MNQIysnFa2QdatbNtnGBe1ndgB28BeI+Mo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=pwRwjOqW; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=BZY4hc8j; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="pwRwjOqW"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="BZY4hc8j" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 65H8UT7m3273524 for ; Wed, 17 Jun 2026 10:28:48 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= ZhZEMTvXJ4lvU6WeVqcP5knOXjwk4Tb18lBp//QSNo4=; b=pwRwjOqWrbf5FSGY 5VmV/wfzVI0mVxz5HCTrZ62nmhQysC1pbwHvsS+/0/sbO53J/A52uynb0LOktg7Q MkIHasSuTR6CKFtT8ho/AlUbT7+KRXS8PKnxXCmw+RAk29/eAqbL09E1VTyctQjC 3993GtdeijB/bnrg2HDpuiOMAl7Pu6S/nuotSnHx1Ar3bFNOb19BtV0vw+4weIze xScr5Uz19E25MGymxM1we2u+A4tOET1O8158sqUWsMW4GOm8fIt8ah1roRb1fd9e 0pzJB+tzJo1u18MNYQNt2CLKyBuJ/5vX2l6Wa0YnOblF0VqVzafDgXYpec/Q9fzV FesO6Q== Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4euefbtn26-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Wed, 17 Jun 2026 10:28:47 +0000 (GMT) Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-36d982d932aso7207925a91.0 for ; Wed, 17 Jun 2026 03:28:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1781692127; x=1782296927; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=ZhZEMTvXJ4lvU6WeVqcP5knOXjwk4Tb18lBp//QSNo4=; b=BZY4hc8jUWOmaF1kQRy4EGEejBKRsI+0BHQHu9JDAZz1MYNt10V3mcsGMlnMByf1Dl dx83NHbb/TCqWVmxw44hRoU3pkdcI9xl7YuNeCSRnanDFZ0Kfp20YlS7XU1jPmIiS08F QLFt0p3BP9ZnsGrH9k6NvbGe1BdsoxAyyiOYy7tgDu9P9pRjUcfAOPdLnBd0DPkF9n7d fyW22I8fv5Eo/9mEgZTgKP9L5Fbr+rBQdxEc5yFRJ/bwlu0+1dJmulZIJ9erY2jNXbbI u8oZdNaR0wWvyw81R7NORCURhCPgg2ub5KzaMI/0qsyxxockO9tqS0+LTu7NCMIS6YzA PLcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781692127; x=1782296927; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=ZhZEMTvXJ4lvU6WeVqcP5knOXjwk4Tb18lBp//QSNo4=; b=e6neUaPt0N0zWp600s0jTZCqas6jPUj10wHyIFupuIeJQfa66U8OWO4ZKXif+aYQaQ BjN1Cf9b860WV9zdmW65qlJ4d9M71yqIwq32EMgIlJcFE+FFe7Ykz69HupoIzyOLpfpE kAP4aTFCT5LGzCcunlt+YhKmcomvF9EW1878iSr3ndJT0M23/wqKD6YehwmP1MBbT55g FW56zd7iMWclGw7Tep663rWvLYRz+kl86e18EM3YosXvPPhVRJiYVwGrXmFS27ru1xSU xoPfn6i+btsWAlvmsQBlaYFS72IpGFVeYezyhLQGkMlKFQUXTa+rgjvzXotSJsdWW+Mb uRYQ== X-Forwarded-Encrypted: i=1; AFNElJ+UeCLhsGN7eyuBWu6XU+NQ+FLbrPpa99xXhGEbqlGRvHGQC4RyB+S5W/CUoKYYmpwYmtqvSfbmQGCx42E=@vger.kernel.org X-Gm-Message-State: AOJu0Yx03tVygq04ptF7zgbbsSJKOWKSkPBQiWTUJK00xgPkVaAou19h Che0IouElAFA3iG/3Vo0zJwDpvopWxF9huwH09Wx/q/wQ2wZ9a6fmk7mScBJWytPpcVVFVwobWf 5O1CRzhk2kg9cSzBxpEc+iDgOzuTjwIlhQ/8DvCBIUmBBP3Q1b19UZnZOHfnXXu1MOwI= X-Gm-Gg: AfdE7ckLG9S8M9MEBuFewhwenRTD3Fhh/kKCDZRtM63LQnSQadB9BJCLpUcAS85kAIL 36EAmrVM2NCipyaY/nVoLlXwMxCCKbxQSLwbzVtwClpoPGgbB3XDK1Ogb/EIK5wgpxXXKmMZP7z alVY4OG5Q8KLdzYvbb1JFEUhLJ1ypxsN/FmbEBCf7o6M2ysNaQeXkrfKVgoXVrvPRqnqRnAordD RUlU8jMaurdRwSDlWUp2D5RuoRJnh0ZNR0QiJ3bp6CvQ8TEP6bcbloOYnkkVmHw7f9mZsTJn/oA SzqaMyOmK2VtzZrO0BP7F8ZYK9xlDxXnzecbJj0EpURmRYe7pSceWKaQn6IayxEOmRqfC08C1Is tKnyW0ly2/AEfdfP7Rks7kuWmLlacWYyrn3+XqpdgZcF7WOdDZz1J58Yq0WueAm9MTz7bMLLJxv jd1RWn/Q== X-Received: by 2002:a17:90b:2547:b0:36d:6315:1de4 with SMTP id 98e67ed59e1d1-37c9ebdd527mr2741511a91.17.1781692127171; Wed, 17 Jun 2026 03:28:47 -0700 (PDT) X-Received: by 2002:a17:90b:2547:b0:36d:6315:1de4 with SMTP id 98e67ed59e1d1-37c9ebdd527mr2741498a91.17.1781692126736; Wed, 17 Jun 2026 03:28:46 -0700 (PDT) Received: from [10.133.33.84] (tpe-colo-wan-fw-bordernet.qualcomm.com. [103.229.16.4]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-37ca1dab259sm1520012a91.2.2026.06.17.03.28.44 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 17 Jun 2026 03:28:46 -0700 (PDT) Message-ID: Date: Wed, 17 Jun 2026 18:28:42 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 3/3] rpmsg: glink: smem: Use modulo for FIFO tail wrap-around in rx_advance To: Dmitry Baryshkov Cc: Bjorn Andersson , Mathieu Poirier , linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-kernel@vger.kernel.org, tony.truong@oss.qualcomm.com, chris.lew@oss.qualcomm.com References: <20260603-rpmsg-improvements-v1-0-dcfc22ed69f7@oss.qualcomm.com> <20260603-rpmsg-improvements-v1-3-dcfc22ed69f7@oss.qualcomm.com> Content-Language: en-US From: Chunkai Deng In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Proofpoint-GUID: eIsCfGVVitqv0o6jhGP3gsbRApUgKPFg X-Authority-Analysis: v=2.4 cv=IeC3n2qa c=1 sm=1 tr=0 ts=6a3276df cx=c_pps a=RP+M6JBNLl+fLTcSJhASfg==:117 a=nuhDOHQX5FNHPW3J6Bj6AA==:17 a=IkcTkHD0fZMA:10 a=FelO9ux0wxsA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=EUspDBNiAAAA:8 a=HCCoXu3ZlwqH8F1Mh14A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=iS9zxrgQBfv6-_F4QbHw:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNjE3MDA5OSBTYWx0ZWRfX5HOG0BLIqne2 8SVusDW7NOsSEwM8sT2vT16b3LJEBg3sxpZ+unEURg3NUPB3TH8LcdUdNX9Ps49Jdw03I7MLo7v ti0tWxXMjJB09Joe7Eqawaa9vp2sitY= X-Proofpoint-ORIG-GUID: eIsCfGVVitqv0o6jhGP3gsbRApUgKPFg X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNjE3MDA5OSBTYWx0ZWRfX9qyUTXmbLA5f 4nG/Trvuoxpyir1TOMz5ctdsWkvKj1FrZaURL3otRGiT/XNACqb/nD5x3qxmPTe6m3XNWfzxStf moQ+uqEESvARbWqppxn24yhUlwSPBy80Q+LqMTZOWoJDm89b6O0m8nrUtQrpzyG1ojcfeUxId5f mVXBPKn811BGgmTCesYoq2G+gwofRwEhQP8ubFTjk4uaO/en/E5hrnAizbXqDNHHjqqHDfoVWoI f2QgwPPvFD04zq6N3L+7l6d0safaMt8NaWlW3DkfsD3Rhj1mHi4DuHlxomodjpZu/UEGYpLNDfJ tJJMbzGco45KQ+USMwRtr6zdPDXJnqVOOdlt0hh8RvQnBokWaclFAMOCFBLDC5+zBpi6obbvtug jXPXP5D52vFw99IsbwquEAyQOGEzYn1d5j0by7BlZ5mjppk57L1FnIAOOdeafZkILw/Uv7UFXdD 0c/uiY2jdegIEz1QMCw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.125,FMLib:17.12.100.49 definitions=2026-06-17_01,2026-06-16_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 lowpriorityscore=0 priorityscore=1501 suspectscore=0 bulkscore=0 adultscore=0 malwarescore=0 spamscore=0 clxscore=1015 impostorscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2606170099 On 6/3/2026 8:01 PM, Dmitry Baryshkov wrote: > On Wed, Jun 03, 2026 at 06:14:30PM +0800, Chunkai Deng wrote: >> glink_smem_rx_advance() wraps the tail index with a single subtraction, >> which only corrects for one full wrap. The advance count is derived from >> remote-supplied packet fields (up to sizeof(glink_msg) + 0xffff bytes); >> if such a count reaches or exceeds pipe->native.length, the tail remains > Would not such a packet already cause issues as it will overflow the > FIFO? Yes -- looking at qcom_glink_rx_data() again, the existing avail check ("avail < sizeof(hdr) + chunk_size") makes the scenario I described in the commit message effectively unreachable in practice: if a remote ever supplied a chunk_size such that the advance count would exceed pipe->native.length, that check would never pass and we would return -EAGAIN indefinitely without ever reaching rx_advance.  So the out-of-bounds offset I described would only arise from a malformed remote, and at that point modulo does not make anything more trustworthy. As mentioned in my reply to Bjorn, I’ll split this patch out and discuss its optimization separately. Thanks, Chunkai >> outside [0, length) after the subtraction and the next FIFO access uses >> an out-of-bounds offset. >> >> Use modulo so the tail is always normalised back into [0, length), >> keeping it consistent with the index bounds enforced by the WARN_ON_ONCE >> checks added to the FIFO helpers. >> >> Signed-off-by: Chunkai Deng >> --- >> drivers/rpmsg/qcom_glink_smem.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/rpmsg/qcom_glink_smem.c b/drivers/rpmsg/qcom_glink_smem.c >> index 42ad315d7910..4f143921b719 100644 >> --- a/drivers/rpmsg/qcom_glink_smem.c >> +++ b/drivers/rpmsg/qcom_glink_smem.c >> @@ -129,7 +129,7 @@ static void glink_smem_rx_advance(struct qcom_glink_pipe *np, >> >> tail += count; >> if (tail >= pipe->native.length) >> - tail -= pipe->native.length; >> + tail %= pipe->native.length; >> >> *pipe->tail = cpu_to_le32(tail); >> } >> >> -- >> 2.34.1 >>