On 3/21/20 9:29 AM, Christophe JAILLET wrote:No, the issue is just theoretical.
The allocation of 'unlink' can be moved before a spin_lock.
This slighly simplifies the error handling if the memory allocation fails,
slightly (spelling nit)
aligns the code structure with what is done in 'vhci_tx_urb()' and reduces
potential lock contention.
Are you seeing any problems or is this a potential lock contention?
If you are seeing issues, please share the problem seen.
Signed-off-by: Christophe JAILLET <christophe.jaillet@xxxxxxxxxx>
---
 drivers/usb/usbip/vhci_hcd.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 65850e9c7190..b909a634260c 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -905,17 +905,16 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
ÂÂÂÂÂÂÂÂÂ /* tcp connection is alive */
ÂÂÂÂÂÂÂÂÂ struct vhci_unlink *unlink;
 - spin_lock(&vdev->priv_lock);
-
This change might simplify the error path, however it could
open a race window with the unlink activity during vhci_shutdown_connection() when the connection is being taken
down. It would be safer to hold both locks as soon as the
connection check is done.
ÂÂÂÂÂÂÂÂÂ /* setup CMD_UNLINK pdu */
ÂÂÂÂÂÂÂÂÂ unlink = kzalloc(sizeof(struct vhci_unlink), GFP_ATOMIC);
ÂÂÂÂÂÂÂÂÂ if (!unlink) {
-ÂÂÂÂÂÂÂÂÂÂÂ spin_unlock(&vdev->priv_lock);
ÂÂÂÂÂÂÂÂÂÂÂÂÂ spin_unlock_irqrestore(&vhci->lock, flags);
ÂÂÂÂÂÂÂÂÂÂÂÂÂ usbip_event_add(&vdev->ud, VDEV_EVENT_ERROR_MALLOC);
ÂÂÂÂÂÂÂÂÂÂÂÂÂ return -ENOMEM;
ÂÂÂÂÂÂÂÂÂ }
 + spin_lock(&vdev->priv_lock);
+
ÂÂÂÂÂÂÂÂÂ unlink->seqnum = atomic_inc_return(&vhci_hcd->seqnum);
ÂÂÂÂÂÂÂÂÂ if (unlink->seqnum == 0xffff)
ÂÂÂÂÂÂÂÂÂÂÂÂÂ pr_info("seqnum max\n");
thanks,
-- Shuah