lkml.org 
[lkml]   [2017]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 4.12 48/65] PCI: Protect pci_error_handlers->reset_notify() usage with device_lock()
Date
4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <hch@lst.de>

commit b014e96d1abbd67404bbe2018937b46466299e9e upstream.

Every method in struct device_driver or structures derived from it like
struct pci_driver MUST provide exclusion vs the driver's ->remove() method,
usually by using device_lock().

Protect use of pci_error_handlers->reset_notify() by holding the device
lock while calling it.

Note:

- pci_dev_lock() calls device_lock() in addition to blocking user-space
config accesses.

- pci_err_handlers->reset_notify() is used inside
pci_dev_save_and_disable() and pci_dev_restore(). We could hold the
device lock directly in pci_reset_notify(), but we expand the region
since we have several calls following each other.

Without this, ->reset_notify() may race with ->remove() calls, which can be
easily triggered in NVMe.

[bhelgaas: changelog, add pci_reset_notify() comment]
[bhelgaas: fold in fix from Dan Carpenter <dan.carpenter@oracle.com>:
http://lkml.kernel.org/r/20170701135323.x5vaj4e2wcs2mcro@mwanda]
Link: http://lkml.kernel.org/r/20170601111039.8913-2-hch@lst.de
Reported-by: Rakesh Pandit <rakesh@tuxera.com>
Tested-by: Rakesh Pandit <rakesh@tuxera.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
drivers/pci/pci.c | 26 ++++++++++++++++++--------
1 file changed, 18 insertions(+), 8 deletions(-)

--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -4141,6 +4141,12 @@ static void pci_reset_notify(struct pci_
{
const struct pci_error_handlers *err_handler =
dev->driver ? dev->driver->err_handler : NULL;
+
+ /*
+ * dev->driver->err_handler->reset_notify() is protected against
+ * races with ->remove() by the device lock, which must be held by
+ * the caller.
+ */
if (err_handler && err_handler->reset_notify)
err_handler->reset_notify(dev, prepare);
}
@@ -4276,11 +4282,13 @@ int pci_reset_function(struct pci_dev *d
if (rc)
return rc;

+ pci_dev_lock(dev);
pci_dev_save_and_disable(dev);

- rc = pci_dev_reset(dev, 0);
+ rc = __pci_dev_reset(dev, 0);

pci_dev_restore(dev);
+ pci_dev_unlock(dev);

return rc;
}
@@ -4300,16 +4308,14 @@ int pci_try_reset_function(struct pci_de
if (rc)
return rc;

- pci_dev_save_and_disable(dev);
+ if (!pci_dev_trylock(dev))
+ return -EAGAIN;

- if (pci_dev_trylock(dev)) {
- rc = __pci_dev_reset(dev, 0);
- pci_dev_unlock(dev);
- } else
- rc = -EAGAIN;
+ pci_dev_save_and_disable(dev);
+ rc = __pci_dev_reset(dev, 0);
+ pci_dev_unlock(dev);

pci_dev_restore(dev);
-
return rc;
}
EXPORT_SYMBOL_GPL(pci_try_reset_function);
@@ -4459,7 +4465,9 @@ static void pci_bus_save_and_disable(str
struct pci_dev *dev;

list_for_each_entry(dev, &bus->devices, bus_list) {
+ pci_dev_lock(dev);
pci_dev_save_and_disable(dev);
+ pci_dev_unlock(dev);
if (dev->subordinate)
pci_bus_save_and_disable(dev->subordinate);
}
@@ -4474,7 +4482,9 @@ static void pci_bus_restore(struct pci_b
struct pci_dev *dev;

list_for_each_entry(dev, &bus->devices, bus_list) {
+ pci_dev_lock(dev);
pci_dev_restore(dev);
+ pci_dev_unlock(dev);
if (dev->subordinate)
pci_bus_restore(dev->subordinate);
}

\
 
 \ /
  Last update: 2017-08-15 03:27    [W:0.297 / U:11.884 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site