firewire: core: use reference counting to invoke address handlers safely

The lifetime of address handler has been managed by linked list and RCU.
This approach was introduced in commit 35202f7d8420 ("firewire: remove
global lock around address handlers, convert to RCU"). The invocations of
address handler are performed within RCU read-side critical sections.

In commit 57e6d9f85fff ("firewire: ohci: use workqueue to handle events
of AR request/response contexts"), the invocations are in a workqueue
context. The approach still imposes limitation that sleeping is not
allowed within RCU read-side critical sections. However, since sleeping
is not permitted within RCU read-side critical sections, this approach
still has a limitation.

This commit adds reference counting to decouple handler invocation from
handler discovery. The linked list and RCU is used to discover the
handlers, while the reference counting is used to invoke them safely.

Link: https://lore.kernel.org/r/20250803122015.236493-2-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>

diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
index d28477d84697c2152017966fab3f70cb3f8d7e66..29ca9f3f14ceb048d3aa4b822512b8f8c87cf3c4 100644 (file)
--- a/drivers/firewire/core-transaction.c
+++ b/drivers/firewire/core-transaction.c
@@ -550,6 +550,23 @@ const struct fw_address_region fw_unit_space_region =
        { .start = 0xfffff0000900ULL, .end = 0x1000000000000ULL, };
 #endif  /*  0  */
 
+static void complete_address_handler(struct kref *kref)
+{
+       struct fw_address_handler *handler = container_of(kref, struct fw_address_handler, kref);
+
+       complete(&handler->done);
+}
+
+static void get_address_handler(struct fw_address_handler *handler)
+{
+       kref_get(&handler->kref);
+}
+
+static int put_address_handler(struct fw_address_handler *handler)
+{
+       return kref_put(&handler->kref, complete_address_handler);
+}
+
 /**
  * fw_core_add_address_handler() - register for incoming requests
  * @handler:   callback
@@ -596,6 +613,8 @@ int fw_core_add_address_handler(struct fw_address_handler *handler,
                if (other != NULL) {
                        handler->offset += other->length;
                } else {
+                       init_completion(&handler->done);
+                       kref_init(&handler->kref);
                        list_add_tail_rcu(&handler->link, &address_handler_list);
                        ret = 0;
                        break;
@@ -621,6 +640,9 @@ void fw_core_remove_address_handler(struct fw_address_handler *handler)
                list_del_rcu(&handler->link);
 
        synchronize_rcu();
+
+       if (!put_address_handler(handler))
+               wait_for_completion(&handler->done);
 }
 EXPORT_SYMBOL(fw_core_remove_address_handler);
 
@@ -913,10 +935,13 @@ static void handle_exclusive_region_request(struct fw_card *card,
        scoped_guard(rcu) {
                handler = lookup_enclosing_address_handler(&address_handler_list, offset,
                                                           request->length);
-               if (handler)
+               if (handler) {
+                       get_address_handler(handler);
                        handler->address_callback(card, request, tcode, destination, source,
                                                  p->generation, offset, request->data,
                                                  request->length, handler->callback_data);
+                       put_address_handler(handler);
+               }
        }
 
        if (!handler)
@@ -952,10 +977,13 @@ static void handle_fcp_region_request(struct fw_card *card,
 
        scoped_guard(rcu) {
                list_for_each_entry_rcu(handler, &address_handler_list, link) {
-                       if (is_enclosing_handler(handler, offset, request->length))
+                       if (is_enclosing_handler(handler, offset, request->length)) {
+                               get_address_handler(handler);
                                handler->address_callback(card, request, tcode, destination, source,
                                                          p->generation, offset, request->data,
                                                          request->length, handler->callback_data);
+                               put_address_handler(handler);
+                       }
                }
        }
 

diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index cceb70415ed2ad4f808cf2b81d63efb1efbb999c..d38c6e538e5c15f0f83e61bc324ad9db1b709732 100644 (file)
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -341,7 +341,11 @@ struct fw_address_handler {
        u64 length;
        fw_address_callback_t address_callback;
        void *callback_data;
+
+       // Only for core functions.
        struct list_head link;
+       struct kref kref;
+       struct completion done;
 };
 
 struct fw_address_region {