[PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer

[PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer

[Liu Jian]

In function do_write_buffer(), in the for loop, there is a case
chip_ready() returns 1 while chip_good() returns 0, so it never
break the loop.
To fix this, chip_good() is enough and it should timeout if it stay
bad for a while.

Fixes: dfeae1073583 ("mtd: cfi_cmdset_0002: Change write buffer to check correct value")
Signed-off-by: Yi Huaijie <yihuaijie@huawei.com>
Signed-off-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Tokunori Ikegami <ikegami_to@yahoo.co.jp>
---
v1->v2:
change git log, put the Fixes tag on a single line

 drivers/mtd/chips/cfi_cmdset_0002.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 72428b6..818e94b 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -1876,14 +1876,14 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
 			continue;
 		}
 
-		if (time_after(jiffies, timeo) && !chip_ready(map, adr))
-			break;
-
 		if (chip_good(map, adr, datum)) {
 			xip_enable(map, chip, adr);
 			goto op_done;
 		}
 
+		if (time_after(jiffies, timeo))
+			break;
+
 		/* Latency issues. Drop the lock, wait a while and retry */
 		UDELAY(map, chip, adr, 1);
 	}
-- 
2.7.4

Re: [PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer

[Vignesh R]

On 20/02/19 2:17 AM, Liu Jian wrote:
> In function do_write_buffer(), in the for loop, there is a case
> chip_ready() returns 1 while chip_good() returns 0, so it never
> break the loop.
> To fix this, chip_good() is enough and it should timeout if it stay
> bad for a while.
> 
> Fixes: dfeae1073583 ("mtd: cfi_cmdset_0002: Change write buffer to check correct value")
> Signed-off-by: Yi Huaijie <yihuaijie@huawei.com>
> Signed-off-by: Liu Jian <liujian56@huawei.com>
> Reviewed-by: Tokunori Ikegami <ikegami_to@yahoo.co.jp>
> ---
> v1->v2:
> change git log, put the Fixes tag on a single line
> 
>  drivers/mtd/chips/cfi_cmdset_0002.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
> index 72428b6..818e94b 100644
> --- a/drivers/mtd/chips/cfi_cmdset_0002.c
> +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
> @@ -1876,14 +1876,14 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
>  			continue;
>  		}
>  
> -		if (time_after(jiffies, timeo) && !chip_ready(map, adr))
> -			break;
> -
>  		if (chip_good(map, adr, datum)) {
>  			xip_enable(map, chip, adr);
>  			goto op_done;
>  		}
>  
> +		if (time_after(jiffies, timeo))
> +			break;
> +

It is quite possible that this thread might be pre-empted just after
chip_good() check but before before time_after(). If the thread, then
resumes execution after timeo has elasped then, this code will wrongly
indicate write failure.

To avoid this case, you should add one more check for check_good() even
when time_after() returns true. Something like:

	if (time_after(jiffies, timeo)) {
		if (chip_good(map, adr, datum)) {
			xip_enable(map, chip, adr);
			goto op_done;
		}
		break;
	}



>  		/* Latency issues. Drop the lock, wait a while and retry */
>  		UDELAY(map, chip, adr, 1);
>  	}
> 

-- 
Regards
Vignesh

RE: [PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer

[liujian (CE)]

> -----Original Message-----
> From: Vignesh R [mailto:vigneshr@ti.com]
> Sent: Friday, February 22, 2019 1:59 PM
> To: liujian (CE) <liujian56@huawei.com>; dwmw2@infradead.org;
> computersforpeace@gmail.com; bbrezillon@kernel.org;
> marek.vasut@gmail.com; richard@nod.at; joakim.tjernlund@infinera.com;
> ikegami@allied-telesis.co.jp; keescook@chromium.org
> Cc: linux-mtd@lists.infradead.org; linux-kernel@vger.kernel.org
> Subject: Re: [PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
> 
> 
> 
> On 20/02/19 2:17 AM, Liu Jian wrote:
> > In function do_write_buffer(), in the for loop, there is a case
> > chip_ready() returns 1 while chip_good() returns 0, so it never break
> > the loop.
> > To fix this, chip_good() is enough and it should timeout if it stay
> > bad for a while.
> >
> > Fixes: dfeae1073583 ("mtd: cfi_cmdset_0002: Change write buffer to
> > check correct value")
> > Signed-off-by: Yi Huaijie <yihuaijie@huawei.com>
> > Signed-off-by: Liu Jian <liujian56@huawei.com>
> > Reviewed-by: Tokunori Ikegami <ikegami_to@yahoo.co.jp>
> > ---
> > v1->v2:
> > change git log, put the Fixes tag on a single line
> >
> >  drivers/mtd/chips/cfi_cmdset_0002.c | 6 +++---
> >  1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c
> > b/drivers/mtd/chips/cfi_cmdset_0002.c
> > index 72428b6..818e94b 100644
> > --- a/drivers/mtd/chips/cfi_cmdset_0002.c
> > +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
> > @@ -1876,14 +1876,14 @@ static int __xipram do_write_buffer(struct
> map_info *map, struct flchip *chip,
> >  			continue;
> >  		}
> >
> > -		if (time_after(jiffies, timeo) && !chip_ready(map, adr))
> > -			break;
> > -
> >  		if (chip_good(map, adr, datum)) {
> >  			xip_enable(map, chip, adr);
> >  			goto op_done;
> >  		}
> >
> > +		if (time_after(jiffies, timeo))
> > +			break;
> > +
> 
> It is quite possible that this thread might be pre-empted just after
> chip_good() check but before before time_after(). If the thread, then resumes
> execution after timeo has elasped then, this code will wrongly indicate write
> failure.
> 
> To avoid this case, you should add one more check for check_good() even when
> time_after() returns true. Something like:
> 
> 	if (time_after(jiffies, timeo)) {
> 		if (chip_good(map, adr, datum)) {
> 			xip_enable(map, chip, adr);
> 			goto op_done;
> 		}
> 		break;
> 	}
> 
So,  the patch should like this ?

diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 72428b6..3da2376 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -1876,7 +1876,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
                        continue;
                }

-               if (time_after(jiffies, timeo) && !chip_ready(map, adr))
+               if (time_after(jiffies, timeo) && !chip_good(map, adr, datum))
                        break;

                if (chip_good(map, adr, datum)) {



Any other opinions?
If there are no other comments, I will send a patch again

> 
> >  		/* Latency issues. Drop the lock, wait a while and retry */
> >  		UDELAY(map, chip, adr, 1);
> >  	}
> >
> 
> --
> Regards
> Vignesh

Re: [PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer

[Vignesh R]

On 22-Feb-19 8:20 PM, liujian (CE) wrote:
> 
>> -----Original Message-----
>> From: Vignesh R [mailto:vigneshr@ti.com]
>> Sent: Friday, February 22, 2019 1:59 PM
>> To: liujian (CE) <liujian56@huawei.com>; dwmw2@infradead.org;
>> computersforpeace@gmail.com; bbrezillon@kernel.org;
>> marek.vasut@gmail.com; richard@nod.at; joakim.tjernlund@infinera.com;
>> ikegami@allied-telesis.co.jp; keescook@chromium.org
>> Cc: linux-mtd@lists.infradead.org; linux-kernel@vger.kernel.org
>> Subject: Re: [PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
>>
>>
>>
>> On 20/02/19 2:17 AM, Liu Jian wrote:
>>> In function do_write_buffer(), in the for loop, there is a case
>>> chip_ready() returns 1 while chip_good() returns 0, so it never break
>>> the loop.
>>> To fix this, chip_good() is enough and it should timeout if it stay
>>> bad for a while.
>>>
>>> Fixes: dfeae1073583 ("mtd: cfi_cmdset_0002: Change write buffer to
>>> check correct value")
>>> Signed-off-by: Yi Huaijie <yihuaijie@huawei.com>
>>> Signed-off-by: Liu Jian <liujian56@huawei.com>
>>> Reviewed-by: Tokunori Ikegami <ikegami_to@yahoo.co.jp>
>>> ---
>>> v1->v2:
>>> change git log, put the Fixes tag on a single line
>>>
>>>  drivers/mtd/chips/cfi_cmdset_0002.c | 6 +++---
>>>  1 file changed, 3 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c
>>> b/drivers/mtd/chips/cfi_cmdset_0002.c
>>> index 72428b6..818e94b 100644
>>> --- a/drivers/mtd/chips/cfi_cmdset_0002.c
>>> +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
>>> @@ -1876,14 +1876,14 @@ static int __xipram do_write_buffer(struct
>> map_info *map, struct flchip *chip,
>>>  			continue;
>>>  		}
>>>
>>> -		if (time_after(jiffies, timeo) && !chip_ready(map, adr))
>>> -			break;
>>> -
>>>  		if (chip_good(map, adr, datum)) {
>>>  			xip_enable(map, chip, adr);
>>>  			goto op_done;
>>>  		}
>>>
>>> +		if (time_after(jiffies, timeo))
>>> +			break;
>>> +
>>
>> It is quite possible that this thread might be pre-empted just after
>> chip_good() check but before before time_after(). If the thread, then resumes
>> execution after timeo has elasped then, this code will wrongly indicate write
>> failure.
>>
>> To avoid this case, you should add one more check for check_good() even when
>> time_after() returns true. Something like:
>>
>> 	if (time_after(jiffies, timeo)) {
>> 		if (chip_good(map, adr, datum)) {
>> 			xip_enable(map, chip, adr);
>> 			goto op_done;
>> 		}
>> 		break;
>> 	}
>>
> So,  the patch should like this ?
> 
> diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
> index 72428b6..3da2376 100644
> --- a/drivers/mtd/chips/cfi_cmdset_0002.c
> +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
> @@ -1876,7 +1876,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
>                         continue;
>                 }
> 
> -               if (time_after(jiffies, timeo) && !chip_ready(map, adr))
> +               if (time_after(jiffies, timeo) && !chip_good(map, adr, datum))
>                         break;
> 
>                 if (chip_good(map, adr, datum)) {
> 
> 
> 
> Any other opinions?
> If there are no other comments, I will send a patch again

Looks fine to me.. Please submit a new version. Thanks!

Regards
Vignesh