| From 315615ca944dd94e93272d84fc3dd357b0f3ad48 Mon Sep 17 00:00:00 2001 |
| From: Bjorn Helgaas <bhelgaas@google.com> |
| Date: Thu, 25 Jun 2020 18:14:55 -0500 |
| Subject: [PATCH] PCI: Fix pci_cfg_wait queue locking problem |
| |
| commit 2a7e32d0547f41c5ce244f84cf5d6ca7fccee7eb upstream. |
| |
| The pci_cfg_wait queue is used to prevent user-space config accesses to |
| devices while they are recovering from reset. |
| |
| Previously we used these operations on pci_cfg_wait: |
| |
| __add_wait_queue(&pci_cfg_wait, ...) |
| __remove_wait_queue(&pci_cfg_wait, ...) |
| wake_up_all(&pci_cfg_wait) |
| |
| The wake_up acquires the wait queue lock, but the add and remove do not. |
| |
| Originally these were all protected by the pci_lock, but cdcb33f98244 |
| ("PCI: Avoid possible deadlock on pci_lock and p->pi_lock"), moved |
| wake_up_all() outside pci_lock, so it could race with add/remove |
| operations, which caused occasional kernel panics, e.g., during vfio-pci |
| hotplug/unplug testing: |
| |
| Unable to handle kernel read from unreadable memory at virtual address ffff802dac469000 |
| |
| Resolve this by using wait_event() instead of __add_wait_queue() and |
| __remove_wait_queue(). The wait queue lock is held by both wait_event() |
| and wake_up_all(), so it provides mutual exclusion. |
| |
| Fixes: cdcb33f98244 ("PCI: Avoid possible deadlock on pci_lock and p->pi_lock") |
| Link: https://lore.kernel.org/linux-pci/79827f2f-9b43-4411-1376-b9063b67aee3@huawei.com/T/#u |
| Based-on: https://lore.kernel.org/linux-pci/20191210031527.40136-1-zhengxiang9@huawei.com/ |
| Based-on-patch-by: Xiang Zheng <zhengxiang9@huawei.com> |
| Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> |
| Tested-by: Xiang Zheng <zhengxiang9@huawei.com> |
| Cc: Heyi Guo <guoheyi@huawei.com> |
| Cc: Biaoxiang Ye <yebiaoxiang@huawei.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/pci/access.c b/drivers/pci/access.c |
| index 2fccb5762c76..0914ddeae17f 100644 |
| --- a/drivers/pci/access.c |
| +++ b/drivers/pci/access.c |
| @@ -204,17 +204,13 @@ EXPORT_SYMBOL(pci_bus_set_ops); |
| static DECLARE_WAIT_QUEUE_HEAD(pci_cfg_wait); |
| |
| static noinline void pci_wait_cfg(struct pci_dev *dev) |
| + __must_hold(&pci_lock) |
| { |
| - DECLARE_WAITQUEUE(wait, current); |
| - |
| - __add_wait_queue(&pci_cfg_wait, &wait); |
| do { |
| - set_current_state(TASK_UNINTERRUPTIBLE); |
| raw_spin_unlock_irq(&pci_lock); |
| - schedule(); |
| + wait_event(pci_cfg_wait, !dev->block_cfg_access); |
| raw_spin_lock_irq(&pci_lock); |
| } while (dev->block_cfg_access); |
| - __remove_wait_queue(&pci_cfg_wait, &wait); |
| } |
| |
| /* Returns 0 on success, negative values indicate error. */ |
| -- |
| 2.27.0 |
| |