Re: [PATCH v2] cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer

From: Vignesh R
Date: Fri Feb 22 2019 - 00:58:36 EST




On 20/02/19 2:17 AM, Liu Jian wrote:
> In function do_write_buffer(), in the for loop, there is a case
> chip_ready() returns 1 while chip_good() returns 0, so it never
> break the loop.
> To fix this, chip_good() is enough and it should timeout if it stay
> bad for a while.
>
> Fixes: dfeae1073583 ("mtd: cfi_cmdset_0002: Change write buffer to check correct value")
> Signed-off-by: Yi Huaijie <yihuaijie@xxxxxxxxxx>
> Signed-off-by: Liu Jian <liujian56@xxxxxxxxxx>
> Reviewed-by: Tokunori Ikegami <ikegami_to@xxxxxxxxxxx>
> ---
> v1->v2:
> change git log, put the Fixes tag on a single line
>
> drivers/mtd/chips/cfi_cmdset_0002.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
> index 72428b6..818e94b 100644
> --- a/drivers/mtd/chips/cfi_cmdset_0002.c
> +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
> @@ -1876,14 +1876,14 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
> continue;
> }
>
> - if (time_after(jiffies, timeo) && !chip_ready(map, adr))
> - break;
> -
> if (chip_good(map, adr, datum)) {
> xip_enable(map, chip, adr);
> goto op_done;
> }
>
> + if (time_after(jiffies, timeo))
> + break;
> +

It is quite possible that this thread might be pre-empted just after
chip_good() check but before before time_after(). If the thread, then
resumes execution after timeo has elasped then, this code will wrongly
indicate write failure.

To avoid this case, you should add one more check for check_good() even
when time_after() returns true. Something like:

if (time_after(jiffies, timeo)) {
if (chip_good(map, adr, datum)) {
xip_enable(map, chip, adr);
goto op_done;
}
break;
}



> /* Latency issues. Drop the lock, wait a while and retry */
> UDELAY(map, chip, adr, 1);
> }
>

--
Regards
Vignesh