Commit 17530e71 authored by Jakub Kicinski's avatar Jakub Kicinski Committed by Bjorn Helgaas
Browse files

PCI: Protect pci_driver->sriov_configure() usage with device_lock() 

Every method in struct device_driver or structures derived from it like
struct pci_driver MUST provide exclusion vs the driver's ->remove() method,
usually by using device_lock().

Protect use of pci_driver->sriov_configure() by holding the device lock
while calling it.

The PCI core sets the pci_dev->driver pointer in local_pci_probe() before
calling ->probe() and only clears it after ->remove().  This means driver's
->sriov_configure() callback will happily race with probe() and remove(),
most likely leading to BUGs, since drivers don't expect this.

Remove the iov lock completely, since we remove the last user.

[bhelgaas: changelog, thanks to Christoph for locking rule]
Link: http://lkml.kernel.org/r/20170522225023.14010-1-jakub.kicinski@netronome.com


Signed-off-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
parent d40b7fd2

drivers/pci/iov.c

+0 −4
Original line number Diff line number Diff line
@@ -461,8 +461,6 @@ found: 
	else

		iov->dev = dev;



	mutex_init(&iov->lock);



	dev->sriov = iov;

	dev->is_physfn = 1;

	rc = compute_max_vf_buses(dev);
@@ -491,8 +489,6 @@ static void sriov_release(struct pci_dev *dev) 
	if (dev != dev->sriov->dev)

		pci_dev_put(dev->sriov->dev);



	mutex_destroy(&dev->sriov->lock);



	kfree(dev->sriov);

	dev->sriov = NULL;

}

drivers/pci/pci-sysfs.c

+2 −3
Original line number Diff line number Diff line
@@ -472,7 +472,6 @@ static ssize_t sriov_numvfs_store(struct device *dev, 
				  const char *buf, size_t count)

{

	struct pci_dev *pdev = to_pci_dev(dev);

	struct pci_sriov *iov = pdev->sriov;

	int ret;

	u16 num_vfs;
@@ -483,7 +482,7 @@ static ssize_t sriov_numvfs_store(struct device *dev, 
	if (num_vfs > pci_sriov_get_totalvfs(pdev))

		return -ERANGE;



	mutex_lock(&iov->dev->sriov->lock);

	device_lock(&pdev->dev);



	if (num_vfs == pdev->sriov->num_VFs)

		goto exit;
@@ -518,7 +517,7 @@ static ssize_t sriov_numvfs_store(struct device *dev, 
			 num_vfs, ret);



exit:

	mutex_unlock(&iov->dev->sriov->lock);

	device_unlock(&pdev->dev);



	if (ret < 0)

		return ret;

drivers/pci/pci.h

+0 −1
Original line number Diff line number Diff line
@@ -272,7 +272,6 @@ struct pci_sriov { 
	u16 driver_max_VFs;	/* max num VFs driver supports */

	struct pci_dev *dev;	/* lowest numbered PF */

	struct pci_dev *self;	/* this PF */

	struct mutex lock;	/* lock for setting sriov_numvfs in sysfs */

	resource_size_t barsz[PCI_SRIOV_NUM_BARS];	/* VF BAR size */

	bool drivers_autoprobe;	/* auto probing of VFs by driver */

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE