linux-kernel - Re: [BUGFIX 1/2] PCI/PM: Fix deadlock when unbind device if its parent in D3cold

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6992627.n0xzVn15jf@vostro.rjw.lan>
Date:	Wed, 24 Oct 2012 23:01:24 +0200
From:	"Rafael J. Wysocki" <rjw@...k.pl>
To:	Huang Ying <ying.huang@...el.com>
Cc:	Bjorn Helgaas <bhelgaas@...gle.com>, linux-kernel@...r.kernel.org,
	linux-pci@...r.kernel.org, linux-pm@...r.kernel.org,
	Zhang Yanmin <yanmin.zhang@...el.com>
Subject: Re: [BUGFIX 1/2] PCI/PM: Fix deadlock when unbind device if its parent in D3cold

On Wednesday 24 of October 2012 14:54:13 Huang Ying wrote:
> If a PCI device and its parents are put into D3cold, unbinding the
> device will trigger deadlock as follow:
> 
> - driver_unbind
>   - device_release_driver
>     - device_lock(dev)				<--- previous lock here
>     - __device_release_driver
>       - pm_runtime_get_sync
>         ...
>           - rpm_resume(dev)
>             - rpm_resume(dev->parent)
>               ...
>                 - pci_pm_runtime_resume
>                   ...
>                   - pci_set_power_state
>                     - __pci_start_power_transition
>                       - pci_wakeup_bus(dev->parent->subordinate)
>                         - pci_walk_bus
>                           - device_lock(dev)	<--- dead lock here
> 
> 
> If we do not do device_lock in pci_walk_bus, we can avoid dead lock.
> Device_lock in pci_walk_bus is introduced in commit:
> d71374dafbba7ec3f67371d3b7e9f6310a588808, corresponding email thread
> is: https://lkml.org/lkml/2006/5/26/38.  The patch author Zhang Yanmin
> said device_lock is added to pci_walk_bus because:
> 
>   Some error handling functions call pci_walk_bus. For example, PCIe
>   aer. Here we lock the device, so the driver wouldn't detach from the
>   device, as the cb might call driver's callback function.
> 
> So I fixed the dead lock as follow:
> 
> - remove device_lock from pci_walk_bus
> - add device_lock into callback if callback will call driver's callback
> 
> I checked pci_walk_bus users one by one, and found only PCIe aer needs
> device lock.
> 
> Signed-off-by: Huang Ying <ying.huang@...el.com>
> Cc: Zhang Yanmin <yanmin.zhang@...el.com>

Acked-by: Rafael J. Wysocki <rafael.j.wysocki@...el.com>

> ---
>  drivers/pci/bus.c                  |    3 ---
>  drivers/pci/pcie/aer/aerdrv_core.c |   20 ++++++++++++++++----
>  2 files changed, 16 insertions(+), 7 deletions(-)
> 
> --- a/drivers/pci/bus.c
> +++ b/drivers/pci/bus.c
> @@ -320,10 +320,7 @@ void pci_walk_bus(struct pci_bus *top, i
>  		} else
>  			next = dev->bus_list.next;
>  
> -		/* Run device routines with the device locked */
> -		device_lock(&dev->dev);
>  		retval = cb(dev, userdata);
> -		device_unlock(&dev->dev);
>  		if (retval)
>  			break;
>  	}
> --- a/drivers/pci/pcie/aer/aerdrv_core.c
> +++ b/drivers/pci/pcie/aer/aerdrv_core.c
> @@ -213,6 +213,7 @@ static int report_error_detected(struct
>  	struct aer_broadcast_data *result_data;
>  	result_data = (struct aer_broadcast_data *) data;
>  
> +	device_lock(&dev->dev);
>  	dev->error_state = result_data->state;
>  
>  	if (!dev->driver ||
> @@ -231,12 +232,14 @@ static int report_error_detected(struct
>  				   dev->driver ?
>  				   "no AER-aware driver" : "no driver");
>  		}
> -		return 0;
> +		goto out;
>  	}
>  
>  	err_handler = dev->driver->err_handler;
>  	vote = err_handler->error_detected(dev, result_data->state);
>  	result_data->result = merge_result(result_data->result, vote);
> +out:
> +	device_unlock(&dev->dev);
>  	return 0;
>  }
>  
> @@ -247,14 +250,17 @@ static int report_mmio_enabled(struct pc
>  	struct aer_broadcast_data *result_data;
>  	result_data = (struct aer_broadcast_data *) data;
>  
> +	device_lock(&dev->dev);
>  	if (!dev->driver ||
>  		!dev->driver->err_handler ||
>  		!dev->driver->err_handler->mmio_enabled)
> -		return 0;
> +		goto out;
>  
>  	err_handler = dev->driver->err_handler;
>  	vote = err_handler->mmio_enabled(dev);
>  	result_data->result = merge_result(result_data->result, vote);
> +out:
> +	device_unlock(&dev->dev);
>  	return 0;
>  }
>  
> @@ -265,14 +271,17 @@ static int report_slot_reset(struct pci_
>  	struct aer_broadcast_data *result_data;
>  	result_data = (struct aer_broadcast_data *) data;
>  
> +	device_lock(&dev->dev);
>  	if (!dev->driver ||
>  		!dev->driver->err_handler ||
>  		!dev->driver->err_handler->slot_reset)
> -		return 0;
> +		goto out;
>  
>  	err_handler = dev->driver->err_handler;
>  	vote = err_handler->slot_reset(dev);
>  	result_data->result = merge_result(result_data->result, vote);
> +out:
> +	device_unlock(&dev->dev);
>  	return 0;
>  }
>  
> @@ -280,15 +289,18 @@ static int report_resume(struct pci_dev
>  {
>  	const struct pci_error_handlers *err_handler;
>  
> +	device_lock(&dev->dev);
>  	dev->error_state = pci_channel_io_normal;
>  
>  	if (!dev->driver ||
>  		!dev->driver->err_handler ||
>  		!dev->driver->err_handler->resume)
> -		return 0;
> +		goto out;
>  
>  	err_handler = dev->driver->err_handler;
>  	err_handler->resume(dev);
> +out:
> +	device_unlock(&dev->dev);
>  	return 0;
>  }
>  
> 
-- 
I speak only for myself.
Rafael J. Wysocki, Intel Open Source Technology Center.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/