Patch "cxl: Prevent read/write to AFU config space while AFU not configured" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

cxl: Prevent read/write to AFU config space while AFU not configured

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
cxl-prevent-read-write-to-afu-config-space-while-afu-not-configured.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Andrew Donnellan <[email protected]>
Date: Fri, 9 Dec 2016 17:18:50 +1100
Subject: cxl: Prevent read/write to AFU config space while AFU not configured

From: Andrew Donnellan <[email protected]>

commit 14a3ae34bfd0bcb1cc12d55b06a8584c11fac6fc upstream.

During EEH recovery, we deconfigure all AFUs whilst leaving the corresponding vPHB and virtual PCI device in place.

If something attempts to interact with the AFU's PCI config space (e.g. running lspci) after the AFU has been deconfigured and before it's reconfigured, cxl_pcie_{read,write}_config() will read invalid values from the deconfigured struct cxl_afu and proceed to Oops when they try to dereference pointers that have been set to NULL during deconfiguration.

Add a rwsem to struct cxl_afu so we can prevent interaction with config space while the AFU is deconfigured.

---
 drivers/misc/cxl/cxl.h  |    2 +
 drivers/misc/cxl/main.c |    3 +-
 drivers/misc/cxl/pci.c  |    2 +
 drivers/misc/cxl/vphb.c |   51 +++++++++++++++++++++++++++---------------------
 4 files changed, 35 insertions(+), 23 deletions(-)

@@ -418,6 +418,8 @@ struct cxl_afu {
 	struct dentry *debugfs;
 	struct mutex contexts_lock;
 	spinlock_t afu_cntl_lock;
+	/* Used to block access to AFU config space while deconfigured */
+	struct rw_semaphore configured_rwsem;
 
 	/* AFU error buffer fields and bin attribute for sysfs */
 	u64 eb_len, eb_offset;

@@ -268,7 +268,8 @@ struct cxl_afu *cxl_alloc_afu(struct cxl
 	idr_init(&afu->contexts_idr);
 	mutex_init(&afu->contexts_lock);
 	spin_lock_init(&afu->afu_cntl_lock);
-
+	init_rwsem(&afu->configured_rwsem);
+	down_write(&afu->configured_rwsem);
 	afu->prefault_mode = CXL_PREFAULT_NONE;
 	afu->irqs_max = afu->adapter->user_irqs;
 

@@ -1129,6 +1129,7 @@ static int pci_configure_afu(struct cxl_
 	if ((rc = cxl_native_register_psl_irq(afu)))
 		goto err2;
 
+	up_write(&afu->configured_rwsem);
 	return 0;
 
 err2:

@@ -1141,6 +1142,7 @@ err1:
 
 static void pci_deconfigure_afu(struct cxl_afu *afu)
 {
+	down_write(&afu->configured_rwsem);
 	cxl_native_release_psl_irq(afu);
 	if (afu->adapter->native->sl_ops->release_serr_irq)
 		afu->adapter->native->sl_ops->release_serr_irq(afu);

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/cxl-fix-nested-locking-hang-during-eeh-hotplug.patch queue-4.9/pci-hotplug-pnv-php-remove-warn_on-in-pnv_php_put_slot.patch queue-4.9/cxl-prevent-read-write-to-afu-config-space-while-afu-not-configured.patch queue-4.9/pci-hotplug-pnv-php-disable-surprise-hotplug-capability-on-conflicts.patch