Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
From:   Pingfan Liu <kernelfans@gmail.com>
To:     linux-kernel@vger.kernel.org
Cc:     Pingfan Liu <kernelfans@gmail.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        "Rafael J. Wysocki" <rafael@kernel.org>
Subject: [PATCHv2] genirq/PM: Make for_each_irq_desc() safe of irq_desc release
Date:   Wed, 27 Apr 2022 14:03:38 +0800
Message-Id: <20220427060338.7276-1-kernelfans@gmail.com>
In-Reply-To: <20220420140521.45361-7-kernelfans@gmail.com>
References: <20220420140521.45361-7-kernelfans@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

First, this is a suspicion of the code, not a really encountered bug.

*** The scenario ***

Two threads involved
  threadA "hibernate" runs suspend_device_irqs()
  threadB "rcu_cpu_kthread" runs rcu_core()->rcu_do_batch(), which releases
  object, let's say irq_desc

Zoom in:
  threadA                                               threadB
  for_each_irq_desc(irq, desc) {
      get irq_descA which is under freeing
                                                    --->preempted by rcu_core()->rcu_do_batch()  which releases irq_descA
      raw_spin_lock_irqsave(&desc->lock, flags);
      //Oops

And since in the involved code piece, suspend_device_irqs() runs in a
preemptible context, and there may be more than one thread at this
point. So the preemption can happen.

*** The fix ***

Since there is a blockable synchronize_irq() inside the code piece,
resorting to irq_lock_sparse() to protect the irq_desc from
disappearing.

Signed-off-by: Pingfan Liu <kernelfans@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
To: linux-kernel@vger.kernel.org
---
v1 -> v2: improve commit log
 kernel/irq/pm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c
index ca71123a6130..4b67a4c7de3c 100644
--- a/kernel/irq/pm.c
+++ b/kernel/irq/pm.c
@@ -133,6 +133,7 @@ void suspend_device_irqs(void)
 	struct irq_desc *desc;
 	int irq;
 
+	irq_lock_sparse();
 	for_each_irq_desc(irq, desc) {
 		unsigned long flags;
 		bool sync;
@@ -146,6 +147,7 @@ void suspend_device_irqs(void)
 		if (sync)
 			synchronize_irq(irq);
 	}
+	irq_unlock_sparse();
 }
 EXPORT_SYMBOL_GPL(suspend_device_irqs);
 
@@ -186,6 +188,7 @@ static void resume_irqs(bool want_early)
 	struct irq_desc *desc;
 	int irq;
 
+	/* The early resume stage is free of irq_desc release */
 	for_each_irq_desc(irq, desc) {
 		unsigned long flags;
 		bool is_early = desc->action &&
-- 
2.31.1