When the k3 ring accelerator driver has been modified to add module build
support, try_module_get() and module_put() have been added to update the
module refcnt. One code path has not been updated and it has introduced
an issue where the refcnt is decremented by module_put() in 
k3_ringacc_ring_free() without being incremented previously.
Adding try_module_get() to k3_dmaring_request_dual_ring() ensures the
refcnt is kept up to date.

Signed-off-by: Nicolas Frayer <nfrayer@baylibre.com>
---
 drivers/soc/ti/k3-ringacc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/soc/ti/k3-ringacc.c b/drivers/soc/ti/k3-ringacc.c
index e01e4d815230a..8f131368a7586 100644
--- a/drivers/soc/ti/k3-ringacc.c
+++ b/drivers/soc/ti/k3-ringacc.c
@@ -406,6 +406,11 @@ static int k3_dmaring_request_dual_ring(struct k3_ringacc *ringacc, int fwd_id,
 
 	mutex_lock(&ringacc->req_lock);
 
+	if (!try_module_get(ringacc->dev->driver->owner)) {
+		ret = -EINVAL;
+		goto err_module_get;
+	}
+
 	if (test_bit(fwd_id, ringacc->rings_inuse)) {
 		ret = -EBUSY;
 		goto error;
@@ -421,6 +426,8 @@ static int k3_dmaring_request_dual_ring(struct k3_ringacc *ringacc, int fwd_id,
 	return 0;
 
 error:
+	module_put(ringacc->dev->driver->owner);
+err_module_get:
 	mutex_unlock(&ringacc->req_lock);
 	return ret;
 }
-- 
2.25.1

Hi Nicolas,

On 21/12/2022 22:05, Nicolas Frayer wrote:
> When the k3 ring accelerator driver has been modified to add module build
> support, try_module_get() and module_put() have been added to update the
> module refcnt. One code path has not been updated and it has introduced
> an issue where the refcnt is decremented by module_put() in
> k3_ringacc_ring_free() without being incremented previously.
> Adding try_module_get() to k3_dmaring_request_dual_ring() ensures the
> refcnt is kept up to date.

Good catch!
I had never had my hands on a device with DMSS (BCDMA/PKDMA) and the
original module support was developed and tested on devices with UDMA.

can you add the fixes tag along with my reviewed by tag?

Fixes: c07f216a8b72 ("soc: ti: k3-ringacc: Allow the driver to be built as module")
Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>

> 
> Signed-off-by: Nicolas Frayer <nfrayer@baylibre.com>
> ---
>   drivers/soc/ti/k3-ringacc.c | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/soc/ti/k3-ringacc.c b/drivers/soc/ti/k3-ringacc.c
> index e01e4d815230a..8f131368a7586 100644
> --- a/drivers/soc/ti/k3-ringacc.c
> +++ b/drivers/soc/ti/k3-ringacc.c
> @@ -406,6 +406,11 @@ static int k3_dmaring_request_dual_ring(struct k3_ringacc *ringacc, int fwd_id,
>   
>   	mutex_lock(&ringacc->req_lock);
>   
> +	if (!try_module_get(ringacc->dev->driver->owner)) {
> +		ret = -EINVAL;
> +		goto err_module_get;
> +	}
> +
>   	if (test_bit(fwd_id, ringacc->rings_inuse)) {
>   		ret = -EBUSY;
>   		goto error;
> @@ -421,6 +426,8 @@ static int k3_dmaring_request_dual_ring(struct k3_ringacc *ringacc, int fwd_id,
>   	return 0;
>   
>   error:
> +	module_put(ringacc->dev->driver->owner);
> +err_module_get:
>   	mutex_unlock(&ringacc->req_lock);
>   	return ret;
>   }

-- 
Péter

Le sam. 24 déc. 2022 à 23:01, Péter Ujfalusi
<peter.ujfalusi@gmail.com> a écrit :
>
> Hi Nicolas,
>
> On 21/12/2022 22:05, Nicolas Frayer wrote:
> > When the k3 ring accelerator driver has been modified to add module build
> > support, try_module_get() and module_put() have been added to update the
> > module refcnt. One code path has not been updated and it has introduced
> > an issue where the refcnt is decremented by module_put() in
> > k3_ringacc_ring_free() without being incremented previously.
> > Adding try_module_get() to k3_dmaring_request_dual_ring() ensures the
> > refcnt is kept up to date.
>
> Good catch!
> I had never had my hands on a device with DMSS (BCDMA/PKDMA) and the
> original module support was developed and tested on devices with UDMA.
>
> can you add the fixes tag along with my reviewed by tag?
>
> Fixes: c07f216a8b72 ("soc: ti: k3-ringacc: Allow the driver to be built as module")
> Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
>
> >
> > Signed-off-by: Nicolas Frayer <nfrayer@baylibre.com>
> > ---
> >   drivers/soc/ti/k3-ringacc.c | 7 +++++++
> >   1 file changed, 7 insertions(+)
> >
> > diff --git a/drivers/soc/ti/k3-ringacc.c b/drivers/soc/ti/k3-ringacc.c
> > index e01e4d815230a..8f131368a7586 100644
> > --- a/drivers/soc/ti/k3-ringacc.c
> > +++ b/drivers/soc/ti/k3-ringacc.c
> > @@ -406,6 +406,11 @@ static int k3_dmaring_request_dual_ring(struct k3_ringacc *ringacc, int fwd_id,
> >
> >       mutex_lock(&ringacc->req_lock);
> >
> > +     if (!try_module_get(ringacc->dev->driver->owner)) {
> > +             ret = -EINVAL;
> > +             goto err_module_get;
> > +     }
> > +
> >       if (test_bit(fwd_id, ringacc->rings_inuse)) {
> >               ret = -EBUSY;
> >               goto error;
> > @@ -421,6 +426,8 @@ static int k3_dmaring_request_dual_ring(struct k3_ringacc *ringacc, int fwd_id,
> >       return 0;
> >
> >   error:
> > +     module_put(ringacc->dev->driver->owner);
> > +err_module_get:
> >       mutex_unlock(&ringacc->req_lock);
> >       return ret;
> >   }
>
> --
> Péter
Thanks Peter, I'll send a v2 with the tags.