Commit 2a7e32d0 authored Jun 25, 2020 by Bjorn Helgaas

PCI: Fix pci_cfg_wait queue locking problem

The pci_cfg_wait queue is used to prevent user-space config accesses to
devices while they are recovering from reset.

Previously we used these operations on pci_cfg_wait:

  __add_wait_queue(&pci_cfg_wait, ...)
  __remove_wait_queue(&pci_cfg_wait, ...)
  wake_up_all(&pci_cfg_wait)

The wake_up acquires the wait queue lock, but the add and remove do not.

Originally these were all protected by the pci_lock, but cdcb33f9
("PCI: Avoid possible deadlock on pci_lock and p->pi_lock"), moved
wake_up_all() outside pci_lock, so it could race with add/remove
operations, which caused occasional kernel panics, e.g., during vfio-pci
hotplug/unplug testing:

  Unable to handle kernel read from unreadable memory at virtual address ffff802dac469000

Resolve this by using wait_event() instead of __add_wait_queue() and
__remove_wait_queue().  The wait queue lock is held by both wait_event()
and wake_up_all(), so it provides mutual exclusion.

Fixes: cdcb33f9 ("PCI: Avoid possible deadlock on pci_lock and p->pi_lock")
Link: https://lore.kernel.org/linux-pci/79827f2f-9b43-4411-1376-b9063b67aee3@huawei.com/T/#u
Based-on: https://lore.kernel.org/linux-pci/20191210031527.40136-1-zhengxiang9@huawei.com/


Based-on-patch-by: Xiang Zheng <zhengxiang9@huawei.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Xiang Zheng <zhengxiang9@huawei.com>
Cc: Heyi Guo <guoheyi@huawei.com>
Cc: Biaoxiang Ye <yebiaoxiang@huawei.com>

parent b3a9e3b9

drivers/pci/access.c

+2 −6

Original line number	Diff line number	Diff line
		@@ -204,17 +204,13 @@ EXPORT_SYMBOL(pci_bus_set_ops);
		static DECLARE_WAIT_QUEUE_HEAD(pci_cfg_wait);

		static noinline void pci_wait_cfg(struct pci_dev *dev)
		__must_hold(&pci_lock)
		{
		DECLARE_WAITQUEUE(wait, current);

		__add_wait_queue(&pci_cfg_wait, &wait);
		do {
		set_current_state(TASK_UNINTERRUPTIBLE);
		raw_spin_unlock_irq(&pci_lock);
		schedule();
		wait_event(pci_cfg_wait, !dev->block_cfg_access);
		raw_spin_lock_irq(&pci_lock);
		} while (dev->block_cfg_access);
		__remove_wait_queue(&pci_cfg_wait, &wait);
		}

		/* Returns 0 on success, negative values indicate error. */

Admin message