Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220420140521.45361-1-kernelfans@gmail.com> <20220420140521.45361-7-kernelfans@gmail.com>
 <CAJZ5v0h2SWN-=-5=OsMGm1amMJrYELqM6BC+J=98EAxSUmxMqg@mail.gmail.com> <YmDP93yLJw5gsjtQ@piliu.users.ipa.redhat.com>
In-Reply-To: <YmDP93yLJw5gsjtQ@piliu.users.ipa.redhat.com>
From:   "Rafael J. Wysocki" <rafael@kernel.org>
Date:   Thu, 21 Apr 2022 12:57:28 +0200
Message-ID: <CAJZ5v0g9DZax-U4WnVcUCc0zAD0uwZZ7E6wsGXmVCB6MeebWxw@mail.gmail.com>
Subject: Re: [PATCH 6/9] pm/irq: make for_each_irq_desc() safe of irq_desc release
To:     Pingfan Liu <kernelfans@gmail.com>
Cc:     "Rafael J. Wysocki" <rafael@kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Thu, Apr 21, 2022 at 5:31 AM Pingfan Liu <kernelfans@gmail.com> wrote:
>
> On Wed, Apr 20, 2022 at 06:23:48PM +0200, Rafael J. Wysocki wrote:
> > On Wed, Apr 20, 2022 at 4:06 PM Pingfan Liu <kernelfans@gmail.com> wrote:
> > >
> > > The invloved context is no a RCU read section. Furthermore there may be
> > > more than one task at this point. Hence it demands a measure to prevent
> > > irq_desc from freeing. Use irq_lock_sparse to serve the protection
> > > purpose.
> >
> > Can you please describe an example scenario in which the added locking
> > will prevent a failure from occurring?
> >
>
> Sorry to forget mentioning that this is based on the code analysis.
>
> Suppose the following scenario:
> Two threads invloved
>   threadA "hibernate" runs suspend_device_irqs()
>   threadB "rcu_cpu_kthread" runs rcu_core()->rcu_do_batch(), which releases
>   object, let's say irq_desc
>
> Zoom in:
>   threadA                                               threadB
>   for_each_irq_desc(irq, desc) {
>       get irq_descA which is under freeing
>                                                     --->preempted by rcu_core()->rcu_do_batch()  which releases irq_descA
>       raw_spin_lock_irqsave(&desc->lock, flags);
>       //Oops
>
> And since in the involved code piece, threadA runs in a preemptible
> context, and there may be more than one thread at this stage. So the
> preempted can happen.

Well, I'm still not sure that this can ever trigger in practice, but I
guess the locking can be added for extra safety.

Anyway, the above information should go into the changelog IMO.

That said ->

> > > Signed-off-by: Pingfan Liu <kernelfans@gmail.com>
> > > Cc: Thomas Gleixner <tglx@linutronix.de>
> > > Cc: "Rafael J. Wysocki" <rafael@kernel.org>
> > > To: linux-kernel@vger.kernel.org
> > > ---
> > >  kernel/irq/pm.c | 3 +++
> > >  1 file changed, 3 insertions(+)
> > >
> > > diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
> > > index ca71123a6130..4b67a4c7de3c 100644
> > > --- a/kernel/irq/pm.c
> > > +++ b/kernel/irq/pm.c
> > > @@ -133,6 +133,7 @@ void suspend_device_irqs(void)
> > >         struct irq_desc *desc;
> > >         int irq;
> > >
> > > +       irq_lock_sparse();
> > >         for_each_irq_desc(irq, desc) {
> > >                 unsigned long flags;
> > >                 bool sync;
> > > @@ -146,6 +147,7 @@ void suspend_device_irqs(void)
> > >                 if (sync)
> > >                         synchronize_irq(irq);

-> is it entirely safe to call synchronize_irq() under irq_lock_sparse?

> > >         }
> > > +       irq_unlock_sparse();
> > >  }
> > >  EXPORT_SYMBOL_GPL(suspend_device_irqs);
> > >
> > > @@ -186,6 +188,7 @@ static void resume_irqs(bool want_early)
> > >         struct irq_desc *desc;
> > >         int irq;
> > >
> > > +       /* The early resume stage is free of irq_desc release */
> > >         for_each_irq_desc(irq, desc) {
> > >                 unsigned long flags;
> > >                 bool is_early = desc->action &&
> > > --
> > > 2.31.1
> > >