tty/n_gsm.c: use gsm->num to remove mux itself from gsm_mux[]

PATCH RESEND Superseded Pan Xinhui 2 participants 3 messages Dec 14, 2015 – Jan 5, 2016 1 message not in the archive TTY layer and serial drivers

lore

Share & tools

lore

Pan Xinhui

author

2015-12-14 07:08 UTC #0 lore raw

PATCH RESEND 1/1 tty/n_gsm.c: use gsm->num to remove mux itself from gsm_mux[]

From: Pan Xinhui <[email protected]>

There is one filed gsm->num to store mux's index of gsm_mux[]. So use gsm->num to remove itself from gsm_mux[] instead of the for-loop traverse in gsm_cleanup_mux().

Signed-off-by Pan Xinhui <[email protected]>

---
 drivers/tty/n_gsm.c |   14 +++++---------
 1 files changed, 5 insertions(+), 9 deletions(-)

drivers/tty/n_gsm.c +5 -9

index 9aff371..cf28054 100644
@@ -2037,18 +2037,14 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm)
 
 	gsm->dead = 1;
 
-	spin_lock(&gsm_mux_lock);
-	for (i = 0; i < MAX_MUX; i++) {
-		if (gsm_mux[i] == gsm) {
-			gsm_mux[i] = NULL;
-			break;
-		}
-	}
-	spin_unlock(&gsm_mux_lock);
 	/* open failed before registering => nothing to do */
-	if (i == MAX_MUX)
+	if (gsm_mux[gsm->num] != gsm)
 		return;
 
+	spin_lock(&gsm_mux_lock);
+	gsm_mux[gsm->num] = NULL;
+	spin_unlock(&gsm_mux_lock);
+
 	/* In theory disconnecting DLCI 0 is sufficient but for some
 	   modems this is apparently not the case. */
 	if (dlci) {

Signature · 1 line

1.7.1

One Thousand Gnomes

2015-12-14 15:41 UTC #1 lore raw

Quoted 25 lines · On Mon, 14 Dec 2015 15:08:03 +0800 Pan Xinhui <[email protected]>…

From: Pan Xinhui <[email protected]>
There is one filed gsm->num to store mux's index of gsm_mux[]. So use gsm->num to remove itself from gsm_mux[] instead of the for-loop traverse in gsm_cleanup_mux().
Signed-off-by Pan Xinhui <[email protected]>
---
 drivers/tty/n_gsm.c |   14 +++++---------
 1 files changed, 5 insertions(+), 9 deletions(-)
drivers/tty/n_gsm.c +0 -6
index 9aff371..cf28054 100644
@@ -2037,18 +2037,14 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm)
 
 	gsm->dead = 1;
 
-	spin_lock(&gsm_mux_lock);
-	for (i = 0; i < MAX_MUX; i++) {
-		if (gsm_mux[i] == gsm) {
-			gsm_mux[i] = NULL;
-			break;
-		}

drivers/tty/n_gsm.c static void gsm_cleanup_mux(struct gsm_mux *gsm) · line 2046

Quoted 10 lines

drivers/tty/n_gsm.c +4 -3

-	}
-	spin_unlock(&gsm_mux_lock);
 	/* open failed before registering => nothing to do */
-	if (i == MAX_MUX)
+	if (gsm_mux[gsm->num] != gsm)
 		return;
 
+	spin_lock(&gsm_mux_lock);
+	gsm_mux[gsm->num] = NULL;
+	spin_unlock(&gsm_mux_lock);

Its a highly theoretical and probably impossible corner case but I can't help thinking the lock should be held for the if () as well as NULLing this out.

Alan

A message that is not in the archive (sent off-list or not yet received): [email protected]

Pan Xinhui

author

2016-01-05 06:35 UTC #3 lore raw

Hi, Alan
thanks for your reply :)

Quoted 47 lines · xinhui

hi, Alan
this is xinhui. My eyes got badly hurt, and i am ooo this whole week and next coming week. sorry for late responce. I just review the codes in my mind. gsm ioctl callback might change gsm->num, so you are right. i still have many confusion. but tears came out several times:( when i am back, i will reply you again.
thx
xinhui
On 2015-12-14 23:40 , One Thousand Gnomes Wrote:
Quoted 32 lines · On Mon, 14 Dec 2015 15:08:03 +0800 Pan Xinhui <[email protected]>…
From: Pan Xinhui <[email protected]>
There is one filed gsm->num to store mux's index of gsm_mux[]. So use gsm->num to remove itself from gsm_mux[] instead of the for-loop traverse in gsm_cleanup_mux().
Signed-off-by Pan Xinhui <[email protected]>
---
  drivers/tty/n_gsm.c |   14 +++++---------
  1 files changed, 5 insertions(+), 9 deletions(-)
drivers/tty/n_gsm.c +1 -9
index 9aff371..cf28054 100644
@@ -2037,18 +2037,14 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm)
 
       gsm->dead = 1;
 
-     spin_lock(&gsm_mux_lock);
-     for (i = 0; i < MAX_MUX; i++) {
-          if (gsm_mux[i] == gsm) {
-               gsm_mux[i] = NULL;
-               break;
-          }
-     }
-     spin_unlock(&gsm_mux_lock);
       /* open failed before registering => nothing to do */
-     if (i == MAX_MUX)
+     if (gsm_mux[gsm->num] != gsm)
            return;
 

Quoted 8 lines

drivers/tty/n_gsm.c static void gsm_cleanup_mux(struct gsm_mux *gsm) · line 2046
Quoted 3 lines
drivers/tty/n_gsm.c +3 -0
+     spin_lock(&gsm_mux_lock);
+     gsm_mux[gsm->num] = NULL;
+     spin_unlock(&gsm_mux_lock);
Its a highly theoretical and probably impossible corner case but I can't help thinking the lock should be held for the if () as well as NULLing this out.

yes, gsm_mux[] must be touched with gsm_mux_lock held.

I am still wondering if it's possible that two gsm_cleanup_mux() run on the same mux.
seems gsmld_config() -> gsm_cleanup_mux() might have race with gsmld_detach_gsm() -> gsm_cleanup_mux().
what's more, we need make sure gsm_mux[gsm->num] == gsm, as if there is a new mux put into gsm_mux[], we might NULL this new mux out.

here is one possible race.
CPUA CPUB CPUC
in cleanup() in cleanup() in activate()
if (gsm_mux[gsm->num] != gsm) if (gsm_mux[gsm->num] != gsm)
.. ...
spin_lock(&gsm_mux_lock);
gsm_mux[gsm->num] = NULL;

spin_unlock(&gsm_mux_lock);
									spin_lock(&gsm_mux_lock);
									...
										gsm->num = i;
										gsm_mux[i] = gsm;
									...
									spin_unlock(&gsm_mux_lock);
				spin_lock(&gsm_mux_lock);
				gsm_mux[gsm->num] = NULL;//this NULLing might cause BUGS!!
				spin_unlock(&gsm_mux_lock);

I will send out patch V2 to avoid any possible race. thanks for pointing it out.

thanks
xinhui

Quoted 2 lines

Alan