From patchwork Mon Aug 8 15:47:51 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Keith Busch X-Patchwork-Id: 9268607 X-Patchwork-Delegate: bhelgaas@google.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7F5576075A for ; Mon, 8 Aug 2016 15:48:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 715722815E for ; Mon, 8 Aug 2016 15:48:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 66005283F6; Mon, 8 Aug 2016 15:48:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0AFD72815E for ; Mon, 8 Aug 2016 15:48:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752132AbcHHPr7 (ORCPT ); Mon, 8 Aug 2016 11:47:59 -0400 Received: from mga11.intel.com ([192.55.52.93]:22536 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752125AbcHHPr6 (ORCPT ); Mon, 8 Aug 2016 11:47:58 -0400 Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga102.fm.intel.com with ESMTP; 08 Aug 2016 08:47:59 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.28,490,1464678000"; d="scan'208";a="861732733" Received: from dcgshare.lm.intel.com ([10.232.118.254]) by orsmga003.jf.intel.com with ESMTP; 08 Aug 2016 08:47:57 -0700 Received: by dcgshare.lm.intel.com (Postfix, from userid 1017) id 199B5E0C6D; Mon, 8 Aug 2016 09:47:56 -0600 (MDT) From: Keith Busch To: linux-pci@vger.kernel.org, Bjorn Helgaas Cc: Jon Derrick , Keith Busch Subject: [PATCH v2] vmd: Fix infinite loop executing irq's Date: Mon, 8 Aug 2016 09:47:51 -0600 Message-Id: <1470671271-22465-1-git-send-email-keith.busch@intel.com> X-Mailer: git-send-email 1.7.1 Sender: linux-pci-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP We can't initialize the list head on deletion as this causes the node to point to itself, looping infinitely if the vmd IRQ handler happened to be servicing that node. The list initialization was trying fix a bug from multiple calls to disable the same IRQ. We can fix this instead by having the vmd driver track if the interrupt is enabled. Signed-off-by: Keith Busch Cc: Jon Derrick Reported-by: Grzegorz Koczot Tested-by: Miroslaw Drost --- v1 -> v2: Removed check for poisioned list pointer. This is abusing knowledge internal to the list api, so we need another way to know if the child irq is enabled. This patch uses a driver controlled boolean for this. Added tags for the bug reporter and tester. arch/x86/pci/vmd.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/x86/pci/vmd.c b/arch/x86/pci/vmd.c index e88b417..4b85837 100644 --- a/arch/x86/pci/vmd.c +++ b/arch/x86/pci/vmd.c @@ -41,6 +41,7 @@ static DEFINE_RAW_SPINLOCK(list_lock); * @node: list item for parent traversal. * @rcu: RCU callback item for freeing. * @irq: back pointer to parent. + * @enabled: true if driver enabled irq * @virq: the virtual IRQ value provided to the requesting driver. * * Every MSI/MSI-X IRQ requested for a device in a VMD domain will be mapped to @@ -50,6 +51,7 @@ struct vmd_irq { struct list_head node; struct rcu_head rcu; struct vmd_irq_list *irq; + bool enabled; unsigned int virq; }; @@ -122,7 +124,9 @@ static void vmd_irq_enable(struct irq_data *data) unsigned long flags; raw_spin_lock_irqsave(&list_lock, flags); + WARN_ON(vmdirq->enabled); list_add_tail_rcu(&vmdirq->node, &vmdirq->irq->irq_list); + vmdirq->enabled = true; raw_spin_unlock_irqrestore(&list_lock, flags); data->chip->irq_unmask(data); @@ -136,8 +140,10 @@ static void vmd_irq_disable(struct irq_data *data) data->chip->irq_mask(data); raw_spin_lock_irqsave(&list_lock, flags); - list_del_rcu(&vmdirq->node); - INIT_LIST_HEAD_RCU(&vmdirq->node); + if (vmdirq->enabled) { + list_del_rcu(&vmdirq->node); + vmdirq->enabled = false; + } raw_spin_unlock_irqrestore(&list_lock, flags); }