[PATCH] mtd: fix race in cfi_cmdset_0001 driver

[Michael Cashwell]

On Feb 7, 2011, at 11:07 AM, Joakim Tjernlund wrote:

> As inval_cache_and_wait_for_operation() drop and reclaim the lock
> to invalidate the cache, some other thread may suspend the operation
> before reaching the for(;;) loop. Therefore the loop must start with
> checking the chip->state before reading status from the chip.
> 
> Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund at transmode.se>
> ---
> 
> David, I think this should go to Linus asap.
> Stefan and Michael, would be great if you could
> reply with a Acked-By: too.
> 
> drivers/mtd/chips/cfi_cmdset_0001.c |   43 ++++++++++++++++++-----------------
> 1 files changed, 22 insertions(+), 21 deletions(-)
> 
> diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
> index e89f2d0..9772a62 100644
> --- a/drivers/mtd/chips/cfi_cmdset_0001.c
> +++ b/drivers/mtd/chips/cfi_cmdset_0001.c
> @@ -1245,10 +1245,32 @@ static int inval_cache_and_wait_for_operation(
> 	sleep_time = chip_op_time / 2;
> 
> 	for (;;) {
> +		if (chip->state != chip_state) {
> +			/* Someone's suspended the operation: sleep */
> +			DECLARE_WAITQUEUE(wait, current);
> +			set_current_state(TASK_UNINTERRUPTIBLE);
> +			add_wait_queue(&chip->wq, &wait);
> +			mutex_unlock(&chip->mutex);
> +			schedule();
> +			remove_wait_queue(&chip->wq, &wait);
> +			mutex_lock(&chip->mutex);
> +			continue;
> +		}
> +
> 		status = map_read(map, cmd_adr);
> 		if (map_word_andequal(map, status, status_OK, status_OK))
> 			break;
> 
> +		if (chip->erase_suspended && chip_state == FL_ERASING)  {
> +			/* Erase suspend occured while sleep: reset timeout */
> +			timeo = reset_timeo;
> +			chip->erase_suspended = 0;
> +		}
> +		if (chip->write_suspended && chip_state == FL_WRITING)  {
> +			/* Write suspend occured while sleep: reset timeout */
> +			timeo = reset_timeo;
> +			chip->write_suspended = 0;
> +		}
> 		if (!timeo) {
> 			map_write(map, CMD(0x70), cmd_adr);
> 			chip->state = FL_STATUS;
> @@ -1272,27 +1294,6 @@ static int inval_cache_and_wait_for_operation(
> 			timeo--;
> 		}
> 		mutex_lock(&chip->mutex);
> -
> -		while (chip->state != chip_state) {
> -			/* Someone's suspended the operation: sleep */
> -			DECLARE_WAITQUEUE(wait, current);
> -			set_current_state(TASK_UNINTERRUPTIBLE);
> -			add_wait_queue(&chip->wq, &wait);
> -			mutex_unlock(&chip->mutex);
> -			schedule();
> -			remove_wait_queue(&chip->wq, &wait);
> -			mutex_lock(&chip->mutex);
> -		}
> -		if (chip->erase_suspended && chip_state == FL_ERASING)  {
> -			/* Erase suspend occured while sleep: reset timeout */
> -			timeo = reset_timeo;
> -			chip->erase_suspended = 0;
> -		}
> -		if (chip->write_suspended && chip_state == FL_WRITING)  {
> -			/* Write suspend occured while sleep: reset timeout */
> -			timeo = reset_timeo;
> -			chip->write_suspended = 0;
> -		}
> 	}
> 
> 	/* Done and happy. */

Acked-by: Michael Cashwell <mboards at prograde.net>

-Mike