2018-09-02 03:42:02

by Jia-Ju Bai

[permalink] [raw]
Subject: [PATCH] pci: dwc: pcie_designware: Fix a sleep-in-atomic-context bug in dw_pcie_prog_outbound_atu

The driver may sleep with holding a spinlock and in an interupt handler.

The function call paths (from bottom to top) in Linux-4.16 are:

[FUNC] usleep_range
drivers/pci/dwc/pcie-designware.c, 181:
usleep_range in dw_pcie_prog_outbound_atu
drivers/pci/dwc/pcie-designware-host.c, 479:
dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
drivers/pci/dwc/pcie-designware-host.c, 561:
dw_pcie_rd_other_conf in dw_pcie_rd_conf
drivers/pci/access.c, 66:
[FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
drivers/pci/access.c, 918:
pci_bus_read_config_word in pci_read_config_word
drivers/block/umem.c, 630:
pci_read_config_word in mm_interrupt (interrupt handler)

[FUNC] usleep_range
drivers/pci/dwc/pcie-designware.c, 181:
usleep_range in dw_pcie_prog_outbound_atu
drivers/pci/dwc/pcie-designware-host.c, 479:
dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
drivers/pci/dwc/pcie-designware-host.c, 561:
dw_pcie_rd_other_conf in dw_pcie_rd_conf
drivers/pci/access.c, 66:
[FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
drivers/pci/access.c, 918:
pci_bus_read_config_word in pci_read_config_word
drivers/ata/pata_efar.c, 115:
pci_read_config_word in efar_set_piomode
drivers/ata/pata_efar.c, 113:
_raw_spin_lock_irqsave in efar_set_piomod

[FUNC] usleep_range
drivers/pci/dwc/pcie-designware.c, 181:
usleep_range in dw_pcie_prog_outbound_atu
drivers/pci/dwc/pcie-designware-host.c, 479:
dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
drivers/pci/dwc/pcie-designware-host.c, 561:
dw_pcie_rd_other_conf in dw_pcie_rd_conf
drivers/pci/access.c, 66:
[FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
drivers/pci/access.c, 918:
pci_bus_read_config_word in pci_read_config_word
drivers/block/mtip32xx/mtip32xx.c, 158:
pci_read_config_word in mtip_check_surprise_removal
drivers/block/mtip32xx/mtip32xx.c, 843:
mtip_check_surprise_removal in mtip_handle_irq
drivers/block/mtip32xx/mtip32xx.c, 879:
mtip_handle_irq in mtip_irq_handler (interrupt handler)

[FUNC] usleep_range
drivers/pci/dwc/pcie-designware.c, 181:
usleep_range in dw_pcie_prog_outbound_atu
drivers/pci/dwc/pcie-designware-host.c, 479:
dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
drivers/pci/dwc/pcie-designware-host.c, 561:
dw_pcie_rd_other_conf in dw_pcie_rd_conf
drivers/pci/access.c, 66:
[FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
drivers/pci/access.c, 918:
pci_bus_read_config_word in pci_read_config_word
drivers/gpu/vga/vgaarb.c, 645:
pci_read_config_word in vga_arbiter_add_pci_device
drivers/gpu/vga/vgaarb.c, 629:
_raw_spin_lock_irqsave in vga_arbiter_add_pci_device

[FUNC] usleep_range
drivers/pci/dwc/pcie-designware.c, 181:
usleep_range in dw_pcie_prog_outbound_atu
drivers/pci/dwc/pcie-designware-host.c, 479:
dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
drivers/pci/dwc/pcie-designware-host.c, 561:
dw_pcie_rd_other_conf in dw_pcie_rd_conf
drivers/pci/access.c, 66:
[FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
drivers/pci/access.c, 918:
pci_bus_read_config_word in pci_read_config_word
drivers/pci/ats.c, 139:
pci_read_config_word in pci_ats_queue_depth
drivers/iommu/intel-iommu.c, 1519:
pci_ats_queue_depth in iommu_enable_dev_iotlb
drivers/iommu/intel-iommu.c, 5295:
iommu_enable_dev_iotlb in intel_iommu_enable_pasid
drivers/iommu/intel-iommu.c, 5241:
_raw_spin_lock_irqsave in intel_iommu_enable_pasid

To fix this bug, usleep_range() is replaced with udelay().

This bug is found by my static analysis tool DSAC.

Signed-off-by: Jia-Ju Bai <[email protected]>
---
drivers/pci/controller/dwc/pcie-designware.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c
index 778c4f76a884..7f50f7e51543 100644
--- a/drivers/pci/controller/dwc/pcie-designware.c
+++ b/drivers/pci/controller/dwc/pcie-designware.c
@@ -135,7 +135,7 @@ static void dw_pcie_prog_outbound_atu_unroll(struct dw_pcie *pci, int index,
if (val & PCIE_ATU_ENABLE)
return;

- usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
+ udelay(LINK_WAIT_IATU_MAX);
}
dev_err(pci->dev, "Outbound iATU is not being enabled\n");
}
--
2.17.0



2018-09-11 07:45:41

by kernel test robot

[permalink] [raw]
Subject: Re: [PATCH] pci: dwc: pcie_designware: Fix a sleep-in-atomic-context bug in dw_pcie_prog_outbound_atu

Hi Jia-Ju,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on pci/next]
[also build test ERROR on v4.19-rc3 next-20180910]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url: https://github.com/0day-ci/linux/commits/Jia-Ju-Bai/pci-dwc-pcie_designware-Fix-a-sleep-in-atomic-context-bug-in-dw_pcie_prog_outbound_atu/20180903-152656
base: https://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci.git next
config: arm-spear13xx_defconfig (attached as .config)
compiler: arm-linux-gnueabi-gcc (Debian 7.2.0-11) 7.2.0
reproduce:
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
GCC_VERSION=7.2.0 make.cross ARCH=arm

All errors (new ones prefixed by >>):

drivers/pci/controller/dwc/pcie-designware.o: In function `dw_pcie_prog_outbound_atu':
>> pcie-designware.c:(.text+0x42c): undefined reference to `__bad_udelay'

---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation


Attachments:
(No filename) (1.22 kB)
.config.gz (18.46 kB)
Download all attachments

2018-09-11 08:43:38

by Gustavo Pimentel

[permalink] [raw]
Subject: Re: [PATCH] pci: dwc: pcie_designware: Fix a sleep-in-atomic-context bug in dw_pcie_prog_outbound_atu

Hi Jia,

On 02/09/2018 04:38, Jia-Ju Bai wrote:
> The driver may sleep with holding a spinlock and in an interupt handler.
>
> The function call paths (from bottom to top) in Linux-4.16 are:
>
> [FUNC] usleep_range
> drivers/pci/dwc/pcie-designware.c, 181:
> usleep_range in dw_pcie_prog_outbound_atu
> drivers/pci/dwc/pcie-designware-host.c, 479:
> dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
> drivers/pci/dwc/pcie-designware-host.c, 561:
> dw_pcie_rd_other_conf in dw_pcie_rd_conf
> drivers/pci/access.c, 66:
> [FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
> drivers/pci/access.c, 918:
> pci_bus_read_config_word in pci_read_config_word
> drivers/block/umem.c, 630:
> pci_read_config_word in mm_interrupt (interrupt handler)
>
> [FUNC] usleep_range
> drivers/pci/dwc/pcie-designware.c, 181:
> usleep_range in dw_pcie_prog_outbound_atu
> drivers/pci/dwc/pcie-designware-host.c, 479:
> dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
> drivers/pci/dwc/pcie-designware-host.c, 561:
> dw_pcie_rd_other_conf in dw_pcie_rd_conf
> drivers/pci/access.c, 66:
> [FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
> drivers/pci/access.c, 918:
> pci_bus_read_config_word in pci_read_config_word
> drivers/ata/pata_efar.c, 115:
> pci_read_config_word in efar_set_piomode
> drivers/ata/pata_efar.c, 113:
> _raw_spin_lock_irqsave in efar_set_piomod
>
> [FUNC] usleep_range
> drivers/pci/dwc/pcie-designware.c, 181:
> usleep_range in dw_pcie_prog_outbound_atu
> drivers/pci/dwc/pcie-designware-host.c, 479:
> dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
> drivers/pci/dwc/pcie-designware-host.c, 561:
> dw_pcie_rd_other_conf in dw_pcie_rd_conf
> drivers/pci/access.c, 66:
> [FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
> drivers/pci/access.c, 918:
> pci_bus_read_config_word in pci_read_config_word
> drivers/block/mtip32xx/mtip32xx.c, 158:
> pci_read_config_word in mtip_check_surprise_removal
> drivers/block/mtip32xx/mtip32xx.c, 843:
> mtip_check_surprise_removal in mtip_handle_irq
> drivers/block/mtip32xx/mtip32xx.c, 879:
> mtip_handle_irq in mtip_irq_handler (interrupt handler)
>
> [FUNC] usleep_range
> drivers/pci/dwc/pcie-designware.c, 181:
> usleep_range in dw_pcie_prog_outbound_atu
> drivers/pci/dwc/pcie-designware-host.c, 479:
> dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
> drivers/pci/dwc/pcie-designware-host.c, 561:
> dw_pcie_rd_other_conf in dw_pcie_rd_conf
> drivers/pci/access.c, 66:
> [FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
> drivers/pci/access.c, 918:
> pci_bus_read_config_word in pci_read_config_word
> drivers/gpu/vga/vgaarb.c, 645:
> pci_read_config_word in vga_arbiter_add_pci_device
> drivers/gpu/vga/vgaarb.c, 629:
> _raw_spin_lock_irqsave in vga_arbiter_add_pci_device
>
> [FUNC] usleep_range
> drivers/pci/dwc/pcie-designware.c, 181:
> usleep_range in dw_pcie_prog_outbound_atu
> drivers/pci/dwc/pcie-designware-host.c, 479:
> dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
> drivers/pci/dwc/pcie-designware-host.c, 561:
> dw_pcie_rd_other_conf in dw_pcie_rd_conf
> drivers/pci/access.c, 66:
> [FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
> drivers/pci/access.c, 918:
> pci_bus_read_config_word in pci_read_config_word
> drivers/pci/ats.c, 139:
> pci_read_config_word in pci_ats_queue_depth
> drivers/iommu/intel-iommu.c, 1519:
> pci_ats_queue_depth in iommu_enable_dev_iotlb
> drivers/iommu/intel-iommu.c, 5295:
> iommu_enable_dev_iotlb in intel_iommu_enable_pasid
> drivers/iommu/intel-iommu.c, 5241:
> _raw_spin_lock_irqsave in intel_iommu_enable_pasid
>
> To fix this bug, usleep_range() is replaced with udelay().
>
> This bug is found by my static analysis tool DSAC.
>
> Signed-off-by: Jia-Ju Bai <[email protected]>
> ---
> drivers/pci/controller/dwc/pcie-designware.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c
> index 778c4f76a884..7f50f7e51543 100644
> --- a/drivers/pci/controller/dwc/pcie-designware.c
> +++ b/drivers/pci/controller/dwc/pcie-designware.c
> @@ -135,7 +135,7 @@ static void dw_pcie_prog_outbound_atu_unroll(struct dw_pcie *pci, int index,
> if (val & PCIE_ATU_ENABLE)
> return;
>
> - usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
> + udelay(LINK_WAIT_IATU_MAX);

You might use the mdelay instead of udelay, however this fix and others were
already made on patch on [1]

[1] https://lkml.org/lkml/2018/9/10/284

Regards,
Gustavo

> }
> dev_err(pci->dev, "Outbound iATU is not being enabled\n");
> }
>


2018-09-11 11:20:16

by Jia-Ju Bai

[permalink] [raw]
Subject: Re: [PATCH] pci: dwc: pcie_designware: Fix a sleep-in-atomic-context bug in dw_pcie_prog_outbound_atu



On 2018/9/11 16:40, Gustavo Pimentel wrote:
> Hi Jia,
>
> On 02/09/2018 04:38, Jia-Ju Bai wrote:
>> The driver may sleep with holding a spinlock and in an interupt handler.
>>
>> The function call paths (from bottom to top) in Linux-4.16 are:
>>
>> [FUNC] usleep_range
>> drivers/pci/dwc/pcie-designware.c, 181:
>> usleep_range in dw_pcie_prog_outbound_atu
>> drivers/pci/dwc/pcie-designware-host.c, 479:
>> dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
>> drivers/pci/dwc/pcie-designware-host.c, 561:
>> dw_pcie_rd_other_conf in dw_pcie_rd_conf
>> drivers/pci/access.c, 66:
>> [FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
>> drivers/pci/access.c, 918:
>> pci_bus_read_config_word in pci_read_config_word
>> drivers/block/umem.c, 630:
>> pci_read_config_word in mm_interrupt (interrupt handler)
>>
>> [FUNC] usleep_range
>> drivers/pci/dwc/pcie-designware.c, 181:
>> usleep_range in dw_pcie_prog_outbound_atu
>> drivers/pci/dwc/pcie-designware-host.c, 479:
>> dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
>> drivers/pci/dwc/pcie-designware-host.c, 561:
>> dw_pcie_rd_other_conf in dw_pcie_rd_conf
>> drivers/pci/access.c, 66:
>> [FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
>> drivers/pci/access.c, 918:
>> pci_bus_read_config_word in pci_read_config_word
>> drivers/ata/pata_efar.c, 115:
>> pci_read_config_word in efar_set_piomode
>> drivers/ata/pata_efar.c, 113:
>> _raw_spin_lock_irqsave in efar_set_piomod
>>
>> [FUNC] usleep_range
>> drivers/pci/dwc/pcie-designware.c, 181:
>> usleep_range in dw_pcie_prog_outbound_atu
>> drivers/pci/dwc/pcie-designware-host.c, 479:
>> dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
>> drivers/pci/dwc/pcie-designware-host.c, 561:
>> dw_pcie_rd_other_conf in dw_pcie_rd_conf
>> drivers/pci/access.c, 66:
>> [FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
>> drivers/pci/access.c, 918:
>> pci_bus_read_config_word in pci_read_config_word
>> drivers/block/mtip32xx/mtip32xx.c, 158:
>> pci_read_config_word in mtip_check_surprise_removal
>> drivers/block/mtip32xx/mtip32xx.c, 843:
>> mtip_check_surprise_removal in mtip_handle_irq
>> drivers/block/mtip32xx/mtip32xx.c, 879:
>> mtip_handle_irq in mtip_irq_handler (interrupt handler)
>>
>> [FUNC] usleep_range
>> drivers/pci/dwc/pcie-designware.c, 181:
>> usleep_range in dw_pcie_prog_outbound_atu
>> drivers/pci/dwc/pcie-designware-host.c, 479:
>> dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
>> drivers/pci/dwc/pcie-designware-host.c, 561:
>> dw_pcie_rd_other_conf in dw_pcie_rd_conf
>> drivers/pci/access.c, 66:
>> [FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
>> drivers/pci/access.c, 918:
>> pci_bus_read_config_word in pci_read_config_word
>> drivers/gpu/vga/vgaarb.c, 645:
>> pci_read_config_word in vga_arbiter_add_pci_device
>> drivers/gpu/vga/vgaarb.c, 629:
>> _raw_spin_lock_irqsave in vga_arbiter_add_pci_device
>>
>> [FUNC] usleep_range
>> drivers/pci/dwc/pcie-designware.c, 181:
>> usleep_range in dw_pcie_prog_outbound_atu
>> drivers/pci/dwc/pcie-designware-host.c, 479:
>> dw_pcie_prog_outbound_atu in dw_pcie_rd_other_conf
>> drivers/pci/dwc/pcie-designware-host.c, 561:
>> dw_pcie_rd_other_conf in dw_pcie_rd_conf
>> drivers/pci/access.c, 66:
>> [FUNC_PTR]dw_pcie_rd_conf in pci_bus_read_config_word
>> drivers/pci/access.c, 918:
>> pci_bus_read_config_word in pci_read_config_word
>> drivers/pci/ats.c, 139:
>> pci_read_config_word in pci_ats_queue_depth
>> drivers/iommu/intel-iommu.c, 1519:
>> pci_ats_queue_depth in iommu_enable_dev_iotlb
>> drivers/iommu/intel-iommu.c, 5295:
>> iommu_enable_dev_iotlb in intel_iommu_enable_pasid
>> drivers/iommu/intel-iommu.c, 5241:
>> _raw_spin_lock_irqsave in intel_iommu_enable_pasid
>>
>> To fix this bug, usleep_range() is replaced with udelay().
>>
>> This bug is found by my static analysis tool DSAC.
>>
>> Signed-off-by: Jia-Ju Bai <[email protected]>
>> ---
>> drivers/pci/controller/dwc/pcie-designware.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c
>> index 778c4f76a884..7f50f7e51543 100644
>> --- a/drivers/pci/controller/dwc/pcie-designware.c
>> +++ b/drivers/pci/controller/dwc/pcie-designware.c
>> @@ -135,7 +135,7 @@ static void dw_pcie_prog_outbound_atu_unroll(struct dw_pcie *pci, int index,
>> if (val & PCIE_ATU_ENABLE)
>> return;
>>
>> - usleep_range(LINK_WAIT_IATU_MIN, LINK_WAIT_IATU_MAX);
>> + udelay(LINK_WAIT_IATU_MAX);
> You might use the mdelay instead of udelay, however this fix and others were
> already made on patch on [1]
>
> [1] https://lkml.org/lkml/2018/9/10/284
>

Okay, that is good.


Best wishes,
Jia-Ju Bai