> -----Original Message-----
> From: Ivan Vecera <[email protected]>
> Sent: Friday, April 15, 2022 8:50 AM
> To: mschmidt <[email protected]>
> Cc: [email protected]; poros <[email protected]>; Brandeburg,
> Jesse <[email protected]>; Nguyen, Anthony L
> <[email protected]>; David S. Miller <[email protected]>;
> Jakub Kicinski <[email protected]>; Paolo Abeni <[email protected]>;
> Saleem, Shiraz <[email protected]>; Ertman, David M
> <[email protected]>; moderated list:INTEL ETHERNET DRIVERS
> <[email protected]>; open list <[email protected]>
> Subject: Re: [PATCH net] ice: Fix race during aux device (un)plugging
>
> On Fri, 15 Apr 2022 13:12:03 +0200
> Michal Schmidt <[email protected]> wrote:
>
> > On Thu, Apr 14, 2022 at 6:39 PM Ivan Vecera <[email protected]> wrote:
> >
> > > Function ice_plug_aux_dev() assigns pf->adev field too early prior
> > > aux device initialization and on other side ice_unplug_aux_dev()
> > > starts aux device deinit and at the end assigns NULL to pf->adev.
> > > This is wrong and can causes a crash when ice_send_event_to_aux()
> > > call occurs during these operations because that function depends
> > > on non-NULL value of pf->adev and does not assume that aux device
> > > is half-initialized or half-destroyed.
> > >
> > > Modify affected functions so pf->adev field is set after aux device
> > > init and prior aux device destroy.
> > >
> > [...]
> >
> > > @@ -320,12 +319,14 @@ int ice_plug_aux_dev(struct ice_pf *pf)
> > > */
> > > void ice_unplug_aux_dev(struct ice_pf *pf)
> > > {
> > > - if (!pf->adev)
> > > + struct auxiliary_device *adev = pf->adev;
> > > +
> > > + if (!adev)
> > > return;
> > >
> > > - auxiliary_device_delete(pf->adev);
> > > - auxiliary_device_uninit(pf->adev);
> > > pf->adev = NULL;
> > > + auxiliary_device_delete(adev);
> > > + auxiliary_device_uninit(adev);
> > > }
> > >
> >
> > Hi Ivan,
> > What prevents ice_unplug_aux_dev() from running immediately after
> > ice_send_event_to_aux() gets past its "if (!pf->adev)" test ?
> > Michal
>
> ice_send_event_to_aux() takes aux device lock. ice_unplug_aux_dev()
> calls auxiliary_device_delete() that calls device_del(). device_del()
> takes device_lock() prior kill_device(). So if ice_send_event_to_aux()
> is in progress then device_del() waits for its completion.
>
> Thanks,
> Ivan
Thanks for the patch Ivan!
Reviewed-by: Dave Ertman <[email protected]>