On Tue, Mar 5, 2024 at 11:54 AM Wolfram Sang <wsa+renesas@xxxxxxxxxxxxxxxxxxxx> wrote: > With the to-be-fixed commit, the reset_work handler cleared 'host->mrq' > outside of the spinlock protected critical section. That leaves a small > race window during execution of 'tmio_mmc_reset()' where the done_work > handler could grab a pointer to the now invalid 'host->mrq'. Both would > use it to call mmc_request_done() causing problems (see link below). > > However, 'host->mrq' cannot simply be cleared earlier inside the > critical section. That would allow new mrqs to come in asynchronously > while the actual reset of the controller still needs to be done. So, > like 'tmio_mmc_set_ios()', an ERR_PTR is used to prevent new mrqs from > coming in but still avoiding concurrency between work handlers. > > Reported-by: Dirk Behme <dirk.behme@xxxxxxxxxxxx> > Closes: https://lore.kernel.org/all/20240220061356.3001761-1-dirk.behme@xxxxxxxxxxxx/ > Fixes: df3ef2d3c92c ("mmc: protect the tmio_mmc driver against a theoretical race") > Signed-off-by: Wolfram Sang <wsa+renesas@xxxxxxxxxxxxxxxxxxxx> > Tested-by: Dirk Behme <dirk.behme@xxxxxxxxxxxx> > Reviewed-by: Dirk Behme <dirk.behme@xxxxxxxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx # 3.0+ Thanks, I gave it a boot run on all boards in my farm, no issues seen. Tested-by: Geert Uytterhoeven <geert+renesas@xxxxxxxxx> Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds
