Dexuan,

On Mon, Apr 16, 2018 at 12:15:06PM +0200, gregkh@linuxfoundation.org wrote:

The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.

Please do as Greg asks in order to complete the stable backport you have requested.

Thanks, Lorenzo

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 021ad274d7dc31611d4f47f7dd4ac7a224526f30 Mon Sep 17 00:00:00 2001 From: Dexuan Cui decui@microsoft.com Date: Thu, 15 Mar 2018 14:20:53 +0000 Subject: [PATCH] PCI: hv: Serialize the present and eject work items

When we hot-remove the device, we first receive a PCI_EJECT message and then receive a PCI_BUS_RELATIONS message with bus_rel->device_count == 0.

The first message is offloaded to hv_eject_device_work(), and the second is offloaded to pci_devices_present_work(). Both the paths can be running list_del(&hpdev->list_entry), causing general protection fault, because system_wq can run them concurrently.

The patch eliminates the race condition.

Since access to present/eject work items is serialized, we do not need the hbus->enum_sem anymore, so remove it.

Fixes: 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs") Link: https://lkml.kernel.org/r/KL1P15301MB00064DA6B4D221123B5241CFBFD70@KL1P15301... Tested-by: Adrian Suhov v-adsuho@microsoft.com Tested-by: Chris Valean v-chvale@microsoft.com Signed-off-by: Dexuan Cui decui@microsoft.com [lorenzo.pieralisi@arm.com: squashed semaphore removal patch] Signed-off-by: Lorenzo Pieralisi lorenzo.pieralisi@arm.com Reviewed-by: Michael Kelley mikelley@microsoft.com Acked-by: Haiyang Zhang haiyangz@microsoft.com Cc: stable@vger.kernel.org # v4.6+ Cc: Vitaly Kuznetsov vkuznets@redhat.com Cc: Jack Morgenstein jackm@mellanox.com Cc: Stephen Hemminger sthemmin@microsoft.com Cc: K. Y. Srinivasan kys@microsoft.com

diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c index 2faf38eab785..b7fd5c157d73 100644 --- a/drivers/pci/host/pci-hyperv.c +++ b/drivers/pci/host/pci-hyperv.c @@ -447,7 +447,6 @@ struct hv_pcibus_device { spinlock_t device_list_lock; /* Protect lists below */ void __iomem *cfg_addr;

• struct semaphore enum_sem; struct list_head resources_for_children;

struct list_head children; @@ -461,6 +460,8 @@ struct hv_pcibus_device { struct retarget_msi_interrupt retarget_msi_interrupt_params; spinlock_t retarget_msi_interrupt_lock;

• struct workqueue_struct *wq;

}; /* @@ -1590,12 +1591,8 @@ static struct hv_pci_dev *get_pcichild_wslot(struct hv_pcibus_device *hbus,

• It must also treat the omission of a previously observed device as
• notification that the device no longer exists.

• • Note that this function is a work item, and it may not be
• • invoked in the order that it was queued. Back to back
• • updates of the list of present devices may involve queuing
• • multiple work items, and this one may run before ones that
• • were sent later. As such, this function only does something
• • if is the last one in the queue.

• • Note that this function is serialized with hv_eject_device_work(),
• • because both are pushed to the ordered workqueue hbus->wq.
  */

static void pci_devices_present_work(struct work_struct *work) { @@ -1616,11 +1613,6 @@ static void pci_devices_present_work(struct work_struct *work) INIT_LIST_HEAD(&removed);

• if (down_interruptible(&hbus->enum_sem)) {

• put_hvpcibus(hbus);
  

• return;
  

• }
• /* Pull this off the queue and process it if it was the last one. */ spin_lock_irqsave(&hbus->device_list_lock, flags); while (!list_empty(&hbus->dr_list)) {

@@ -1637,7 +1629,6 @@ static void pci_devices_present_work(struct work_struct *work) spin_unlock_irqrestore(&hbus->device_list_lock, flags); if (!dr) {

• up(&hbus->enum_sem);
  

  put_hvpcibus(hbus); return; }

@@ -1724,7 +1715,6 @@ static void pci_devices_present_work(struct work_struct *work) break; }

• up(&hbus->enum_sem); put_hvpcibus(hbus); kfree(dr);

} @@ -1770,7 +1760,7 @@ static void hv_pci_devices_present(struct hv_pcibus_device *hbus, spin_unlock_irqrestore(&hbus->device_list_lock, flags); get_hvpcibus(hbus);

• schedule_work(&dr_wrk->wrk);

• queue_work(hbus->wq, &dr_wrk->wrk);

} /** @@ -1848,7 +1838,7 @@ static void hv_pci_eject_device(struct hv_pci_dev *hpdev) get_pcichild(hpdev, hv_pcidev_ref_pnp); INIT_WORK(&hpdev->wrk, hv_eject_device_work); get_hvpcibus(hpdev->hbus);

• schedule_work(&hpdev->wrk);

• queue_work(hpdev->hbus->wq, &hpdev->wrk);

} /** @@ -2461,13 +2451,18 @@ static int hv_pci_probe(struct hv_device *hdev, spin_lock_init(&hbus->config_lock); spin_lock_init(&hbus->device_list_lock); spin_lock_init(&hbus->retarget_msi_interrupt_lock);

• sema_init(&hbus->enum_sem, 1); init_completion(&hbus->remove_event);

• hbus->wq = alloc_ordered_workqueue("hv_pci_%x", 0,

• 			   hbus->sysdata.domain);
  

• if (!hbus->wq) {

• ret = -ENOMEM;
  

• goto free_bus;
  

• }

ret = vmbus_open(hdev->channel, pci_ring_size, pci_ring_size, NULL, 0, hv_pci_onchannelcallback, hbus); if (ret)

• goto free_bus;
  

• goto destroy_wq;
  

hv_set_drvdata(hdev, hbus); @@ -2536,6 +2531,8 @@ static int hv_pci_probe(struct hv_device *hdev, hv_free_config_window(hbus); close: vmbus_close(hdev->channel); +destroy_wq:

• destroy_workqueue(hbus->wq);

free_bus: free_page((unsigned long)hbus); return ret; @@ -2615,6 +2612,7 @@ static int hv_pci_remove(struct hv_device *hdev) irq_domain_free_fwnode(hbus->sysdata.fwnode); put_hvpcibus(hbus); wait_for_completion(&hbus->remove_event);

• destroy_workqueue(hbus->wq); free_page((unsigned long)hbus); return 0;

}