firewire: cdev: fix back-transition for iso_resource_auto client resource

[PATCH] firewire: cdev: fix back-transition for iso_resource_auto client resource

Posted by Takashi Sakamoto 2 days, 1 hour ago

The todo member of iso_resource_auto structure represents the state of the
client resource and normally transitions in the following order:

    ISO_RES_AUTO_ALLOC -> ISO_RES_AUTO_REALLOC -> ISO_RES_AUTO_DEALLOC

However, concurrent access from the work item and the file descriptor
release function can cause the state to transition backwards from
ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC.

Prevent the back-transition by checking the current state before
updating it in the work item.

Fixes: fcabbf40fae5 ("firewire: core: move allocation/reallocation paths into specific branch after isoc resource management in cdev")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
---
 drivers/firewire/core-cdev.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index e49d8a58be09..664952a67a11 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -1397,8 +1397,10 @@ static void iso_resource_auto_work(struct work_struct *work)
 		} else {
 			// Transit from allocation to reallocation, except if the client requested
 			// deallocation in the meantime.
-			scoped_guard(spinlock_irq,  &client->lock)
-				r->todo = ISO_RES_AUTO_REALLOC;
+			scoped_guard(spinlock_irq,  &client->lock) {
+				if (r->todo == ISO_RES_AUTO_ALLOC)
+					r->todo = ISO_RES_AUTO_REALLOC;
+			}
 
 			if (channel >= 0)
 				r->params.channels_mask = BIT_ULL(channel);
-- 
2.53.0

Re: [PATCH] firewire: cdev: fix back-transition for iso_resource_auto client resource

Posted by Takashi Sakamoto 1 day, 14 hours ago

On Tue, Sep 22, 2026 at 10:26:39PM +0900, Takashi Sakamoto wrote:
> The todo member of iso_resource_auto structure represents the state of the
> client resource and normally transitions in the following order:
> 
>     ISO_RES_AUTO_ALLOC -> ISO_RES_AUTO_REALLOC -> ISO_RES_AUTO_DEALLOC
> 
> However, concurrent access from the work item and the file descriptor
> release function can cause the state to transition backwards from
> ISO_RES_AUTO_DEALLOC to ISO_RES_AUTO_REALLOC.
> 
> Prevent the back-transition by checking the current state before
> updating it in the work item.
> 
> Fixes: fcabbf40fae5 ("firewire: core: move allocation/reallocation paths into specific branch after isoc resource management in cdev")
> Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
> ---
>  drivers/firewire/core-cdev.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

Applied to for-linus branch.


Regards

Takashi Sakamoto