From patchwork Thu Jul 30 04:09:20 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yijing Wang X-Patchwork-Id: 6898161 X-Patchwork-Delegate: bhelgaas@google.com Return-Path: X-Original-To: patchwork-linux-pci@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 20D09C05AC for ; Thu, 30 Jul 2015 04:16:53 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 006B92054D for ; Thu, 30 Jul 2015 04:16:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EFAEA2053E for ; Thu, 30 Jul 2015 04:16:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750764AbbG3EQv (ORCPT ); Thu, 30 Jul 2015 00:16:51 -0400 Received: from szxga01-in.huawei.com ([58.251.152.64]:47085 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750759AbbG3EQu (ORCPT ); Thu, 30 Jul 2015 00:16:50 -0400 Received: from 172.24.1.49 (EHLO szxeml430-hub.china.huawei.com) ([172.24.1.49]) by szxrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id CSA79200; Thu, 30 Jul 2015 12:13:32 +0800 (CST) Received: from localhost.localdomain (10.175.100.166) by szxeml430-hub.china.huawei.com (10.82.67.185) with Microsoft SMTP Server id 14.3.158.1; Thu, 30 Jul 2015 12:13:25 +0800 From: Yijing Wang To: Bjorn Helgaas CC: , Yijing Wang , Subject: [PATCH] PCI/ASPM: Don't remove pcie_link_state until we stop the last device Date: Thu, 30 Jul 2015 12:09:20 +0800 Message-ID: <1438229360-370-1-git-send-email-wangyijing@huawei.com> X-Mailer: git-send-email 1.7.1 MIME-Version: 1.0 X-Originating-IP: [10.175.100.166] X-CFilter-Loop: Reflected Sender: linux-pci-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org X-Spam-Status: No, score=-8.3 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Now we stop the pci_bus->devices in reverse order, but in pcie_aspm_exit_link_state(), we only would do something when the device is the last one. void pcie_aspm_exit_link_state(struct pci_dev *pdev) { ... if (!list_is_last(&pdev->bus_list, &parent->subordinate->devices)) goto out; ... } So if we have the following pcie tree, system may crash. [b7-bd]--+-02.0-[bb-bd]--+-00.0-[bc-bd]----01.0-[bd]----00.0 PLX Technology, Inc. Device 0002 +-00.1 PLX Technology, Inc. Device 0002 +-00.2 PLX Technology, Inc. Device 0002 +-00.3 PLX Technology, Inc. Device 0002 \-00.4 PLX Technology, Inc. Device 0002 In this case, we would stop bb:00.4 before bb:00.0, so when we touch bb:00.4, we would call pcie_aspm_exit_link_state(), and free the pcie_link_state. So when we want to stop bd:00.0 and free related pcie_link_state, it would try to access the parent pcie_link_state which has been freed. Part crash call trace: BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 CPU 16 Pid: 33262, comm: IVS_PowerOn RIP: 0010:[] [] pcie_config_aspm_link+0x3f/0x100 RSP: 0018:ffff8801bc577790 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 000000000000e7e6 RDX: 000000000000e6e6 RSI: 00000000ffffc5ec RDI: 0000000000000246 RBP: ffff8801bc5777d0 R08: ffff88007b001000 R09: 00000000003fffff ... Call Trace: [] pcie_config_aspm_path+0x32/0x60 [] pcie_aspm_exit_link_state+0x160/0x560 [] pci_stop_bus_device+0x8c/0xe0 [] pci_stop_bus_device+0x38/0xe0 [] pci_stop_bus_device+0x38/0xe0 [] pci_stop_bus_device+0x38/0xe0 [] pci_stop_bus_device+0x38/0xe0 [] pci_stop_and_remove_bus_device+0x11/0x20 ... Signed-off-by: Yijing Wang CC: stable@vger.kernel.org #3.4+ --- drivers/pci/pcie/aspm.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c index 317e355..c81f549 100644 --- a/drivers/pci/pcie/aspm.c +++ b/drivers/pci/pcie/aspm.c @@ -648,7 +648,8 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev) * All PCIe functions are in one slot, remove one function will remove * the whole slot, so just wait until we are the last function left. */ - if (!list_is_last(&pdev->bus_list, &parent->subordinate->devices)) + if (!(pdev == list_first_entry(&parent->subordinate->devices, + struct pci_dev, bus_list))) goto out; link = parent->link_state;