Patch "PCI: Protect pci_error_handlers->reset_notify() usage with device_lock()" has been added to the 4.12-stable tree

This is a note to let you know that I've just added the patch titled

    PCI: Protect pci_error_handlers->reset_notify() usage with device_lock()

to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
pci-protect-pci_error_handlers-reset_notify-usage-with-device_lock.patch
and it can be found in the queue-4.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Christoph Hellwig <[email protected]>
Date: Thu, 1 Jun 2017 13:10:37 +0200
Subject: PCI: Protect pci_error_handlers->reset_notify() usage with device_lock()

From: Christoph Hellwig <[email protected]>

commit b014e96d1abbd67404bbe2018937b46466299e9e upstream.

Every method in struct device_driver or structures derived from it like struct pci_driver MUST provide exclusion vs the driver's ->remove() method, usually by using device_lock().

Protect use of pci_error_handlers->reset_notify() by holding the device lock while calling it.

Note:

- pci_dev_lock() calls device_lock() in addition to blocking user-space config accesses.

- pci_err_handlers->reset_notify() is used inside pci_dev_save_and_disable() and pci_dev_restore(). We could hold the device lock directly in pci_reset_notify(), but we expand the region since we have several calls following each other.

Without this, ->reset_notify() may race with ->remove() calls, which can be easily triggered in NVMe.

[bhelgaas: changelog, add pci_reset_notify() comment] [bhelgaas: fold in fix from Dan Carpenter <[email protected]>:
http://lkml.kernel.org/r/20170701135323.x5vaj4e2wcs2mcro@mwanda]

---
 drivers/pci/pci.c |   26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

@@ -4141,6 +4141,12 @@ static void pci_reset_notify(struct pci_
 {
 	const struct pci_error_handlers *err_handler =
 			dev->driver ? dev->driver->err_handler : NULL;
+
+	/*
+	 * dev->driver->err_handler->reset_notify() is protected against
+	 * races with ->remove() by the device lock, which must be held by
+	 * the caller.
+	 */
 	if (err_handler && err_handler->reset_notify)
 		err_handler->reset_notify(dev, prepare);
 }

@@ -4276,11 +4282,13 @@ int pci_reset_function(struct pci_dev *d
 	if (rc)
 		return rc;
 
+	pci_dev_lock(dev);
 	pci_dev_save_and_disable(dev);
 
-	rc = pci_dev_reset(dev, 0);
+	rc = __pci_dev_reset(dev, 0);
 
 	pci_dev_restore(dev);
+	pci_dev_unlock(dev);
 
 	return rc;
 }

@@ -4300,16 +4308,14 @@ int pci_try_reset_function(struct pci_de
 	if (rc)
 		return rc;
 
-	pci_dev_save_and_disable(dev);
+	if (!pci_dev_trylock(dev))
+		return -EAGAIN;
 
-	if (pci_dev_trylock(dev)) {
-		rc = __pci_dev_reset(dev, 0);
-		pci_dev_unlock(dev);
-	} else
-		rc = -EAGAIN;
+	pci_dev_save_and_disable(dev);
+	rc = __pci_dev_reset(dev, 0);
+	pci_dev_unlock(dev);
 
 	pci_dev_restore(dev);
-
 	return rc;
 }
 EXPORT_SYMBOL_GPL(pci_try_reset_function);

@@ -4459,7 +4465,9 @@ static void pci_bus_save_and_disable(str
 	struct pci_dev *dev;
 
 	list_for_each_entry(dev, &bus->devices, bus_list) {
+		pci_dev_lock(dev);
 		pci_dev_save_and_disable(dev);
+		pci_dev_unlock(dev);
 		if (dev->subordinate)
 			pci_bus_save_and_disable(dev->subordinate);
 	}

@@ -4474,7 +4482,9 @@ static void pci_bus_restore(struct pci_b
 	struct pci_dev *dev;
 
 	list_for_each_entry(dev, &bus->devices, bus_list) {
+		pci_dev_lock(dev);
 		pci_dev_restore(dev);
+		pci_dev_unlock(dev);
 		if (dev->subordinate)
 			pci_bus_restore(dev->subordinate);
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-4.12/pci-remove-__pci_dev_reset-and-pci_dev_reset.patch queue-4.12/usb-storage-fix-deadlock-involving-host-lock-and-scsi_done.patch queue-4.12/pci-protect-pci_error_handlers-reset_notify-usage-with-device_lock.patch