android/android_kernel_samsung_sm8650
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PCI: switchtec: Fix stdev_release() crash after surprise hot remove

Browse Source 
[ Upstream commit df25461119d987b8c81d232cfe4411e91dcabe66 ]

A PCI device hot removal may occur while stdev->cdev is held open. The call
to stdev_release() then happens during close or exit, at a point way past
switchtec_pci_remove(). Otherwise the last ref would vanish with the
trailing put_device(), just before return.

At that later point in time, the devm cleanup has already removed the
stdev->mmio_mrpc mapping. Also, the stdev->pdev reference was not a counted
one. Therefore, in DMA mode, the iowrite32() in stdev_release() will cause
a fatal page fault, and the subsequent dma_free_coherent(), if reached,
would pass a stale &stdev->pdev->dev pointer.

Fix by moving MRPC DMA shutdown into switchtec_pci_remove(), after
stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent
future accidents.

Reproducible via the script at
https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com

Link: https://lore.kernel.org/r/20231122042316.91208-2-dns@arista.com
Signed-off-by: Daniel Stodden <dns@arista.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Reviewed-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Daniel Stodden 2023-11-21 20:23:16 -08:00 committed by Greg Kroah-Hartman
parent 5e0160dab1
commit 1d83c85922
1 changed files with 17 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
drivers/pci/switch/switchtec.c
View File

@ -1308,13 +1308,6 @@ static void stdev_release(struct device *dev)
{ {
struct switchtec_dev *stdev = to_stdev(dev); struct switchtec_dev *stdev = to_stdev(dev);
if (stdev->dma_mrpc) {
iowrite32(0, &stdev->mmio_mrpc->dma_en);
flush_wc_buf(stdev);
writeq(0, &stdev->mmio_mrpc->dma_addr);
dma_free_coherent(&stdev->pdev->dev, sizeof(*stdev->dma_mrpc),
stdev->dma_mrpc, stdev->dma_mrpc_dma_addr);
}
kfree(stdev); kfree(stdev);
} }
@ -1358,7 +1351,7 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev)
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
stdev->alive = true; stdev->alive = true;
stdev->pdev = pdev; stdev->pdev = pci_dev_get(pdev);
INIT_LIST_HEAD(&stdev->mrpc_queue); INIT_LIST_HEAD(&stdev->mrpc_queue);
mutex_init(&stdev->mrpc_mutex); mutex_init(&stdev->mrpc_mutex);
stdev->mrpc_busy = 0; stdev->mrpc_busy = 0;
@ -1391,6 +1384,7 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev)
return stdev; return stdev;
err_put: err_put:
pci_dev_put(stdev->pdev);
put_device(&stdev->dev); put_device(&stdev->dev);
return ERR_PTR(rc); return ERR_PTR(rc);
} }
@ -1646,6 +1640,18 @@ static int switchtec_init_pci(struct switchtec_dev *stdev,
return 0; return 0;
} }
static void switchtec_exit_pci(struct switchtec_dev *stdev)
{
if (stdev->dma_mrpc) {
iowrite32(0, &stdev->mmio_mrpc->dma_en);
flush_wc_buf(stdev);
writeq(0, &stdev->mmio_mrpc->dma_addr);
dma_free_coherent(&stdev->pdev->dev, sizeof(*stdev->dma_mrpc),
stdev->dma_mrpc, stdev->dma_mrpc_dma_addr);
stdev->dma_mrpc = NULL;
}
}
static int switchtec_pci_probe(struct pci_dev *pdev, static int switchtec_pci_probe(struct pci_dev *pdev,
const struct pci_device_id *id) const struct pci_device_id *id)
{ {
@ -1705,6 +1711,9 @@ static void switchtec_pci_remove(struct pci_dev *pdev)
ida_free(&switchtec_minor_ida, MINOR(stdev->dev.devt)); ida_free(&switchtec_minor_ida, MINOR(stdev->dev.devt));
dev_info(&stdev->dev, "unregistered.\n"); dev_info(&stdev->dev, "unregistered.\n");
stdev_kill(stdev); stdev_kill(stdev);
switchtec_exit_pci(stdev);
pci_dev_put(stdev->pdev);
stdev->pdev = NULL;
put_device(&stdev->dev); put_device(&stdev->dev);
} }