Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 27 Jul 2023 12:53:28 -0700
From:   Dan Williams <dan.j.williams@intel.com>
To:     Bjorn Helgaas <helgaas@kernel.org>, Ira Weiny <ira.weiny@intel.com>
CC:     Bjorn Helgaas <bhelgaas@google.com>,
        Dan Williams <dan.j.williams@intel.com>,
        Jonathan Cameron <Jonathan.Cameron@huawei.com>,
        Lukas Wunner <lukas@wunner.de>,
        Davidlohr Bueso <dave@stgolabs.net>,
        <linux-pci@vger.kernel.org>, <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] PCI/DOE: Fix destroy_work_on_stack() race
Message-ID: <64c2cb38e1769_a88b294e6@dwillia2-xfh.jf.intel.com.notmuch>
References: <20230726-doe-fix-v1-1-af07e614d4dd@intel.com>
 <20230727165910.GA786573@bhelgaas>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20230727165910.GA786573@bhelgaas>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?UzP44kQgjtuewd6GWvWnFdqm+SKEwW2p3nMAOEYLuODZedPwS9K8NfBz7O+y?=
 =?us-ascii?Q?sa9ZjA4sgA1G6yBNJSUUbXcQjxiwwo5YYU/SgO03tVj14gWH9ChwrhtdL9u9?=
 =?us-ascii?Q?AGlQvp7Yr88T3zm2w9pZdCbErq43cxO6mOpmL7Vm9R69MHxpZdbidcT5OIH8?=
 =?us-ascii?Q?mj2dOZWIYq5FXXZE7qyEGEuEQrAUziGlKDygjYNHEA197kOEp6lBszwk2u8y?=
 =?us-ascii?Q?71n0w9eQhfdUXgkxQZq2StEM9svZ/phfPyKFr3dwRD78lXkfMfpNX2Rdysl3?=
 =?us-ascii?Q?Xs0yh3lixug0Ep8cFa8MWKfKY8ZMftwGaFgRpTiNfgqKWwzPt0MH1NEfZ/LF?=
 =?us-ascii?Q?Dss1vFmLTvik6qm+VoPU1XdfG6S0wz/vdbbiu71ARPOxENWDvsho+Oy50+2d?=
 =?us-ascii?Q?0fi00EfSoT5WCsQCMS6GY5KBU/iDsp1driUgESVW51Ajk/7Zm5V0V+A6Ob2t?=
 =?us-ascii?Q?8zZeowk3paFkRDypm9qQDgDH2VN2hMycnB133h9twC9/P5h+1I3zQ1PlocAB?=
 =?us-ascii?Q?mFKG3MPIAhrPhsmSS78YktZCRHS9aMtmckTuRphDNlpg0N/DqIYqYO2o3bWm?=
 =?us-ascii?Q?lpkJdDEXBFh1DZZrDj64H4IoknwCdeaF0Efck3Ck5EAUDX1tnaO+inOafra4?=
 =?us-ascii?Q?4C7uih+aPv5m5F9oV8pL6nBHoK3M/uxOg2pCdDMiCOtKWBIqo1UgQWqNBei9?=
 =?us-ascii?Q?G+DM/w20edK8eXSsIjKRD10tu5pFhp2LWeBXt6ZVLWqvvmSAq5LQxK3AbwWM?=
 =?us-ascii?Q?PwmqQcBhTtlRioMDw4bqMncG6S6nYN5EOrsJkTxyoibqGveVBw3In2YxIDWr?=
 =?us-ascii?Q?kdQcayVR0OWi2MqHswBOwj8t47+dwHP9NolfopFFR5wrWA9N3xKkG60AV2PN?=
 =?us-ascii?Q?cp+MwvRDRUtXGNMBYaF8kka+FclpzYsRXqOeEyIqpohGNR6TSadpqghQr+7r?=
 =?us-ascii?Q?yoE9fy4+NZHVNLeVeCfy8ba+aMIDx0XhB3yOkfhp6riLWnUBodtbJEc6Hppj?=
 =?us-ascii?Q?I+kBvN5LwC3wgTZyqi4NXkg6elQa95qYlcxZaHxuWq+PAQ+GnptN0yXDPNIZ?=
 =?us-ascii?Q?id/3SYiGZPVRoRGiCrKSiIfTr7+GCpGCQBFWG9emYFPVEGFssNTTzNS4r/6S?=
 =?us-ascii?Q?Od65R+GltH5Qxl3NEyxgfkRIKyP2og78B+4ZgFSQHvMFHbwjFmxduh/idKde?=
 =?us-ascii?Q?7xYXdmE+IkgFJjgrj/b4YVbeACqUDET8QKb+rxRlTiz57g+9PdQwGhrlQ18X?=
 =?us-ascii?Q?Wyxp86yflMkn8mLMZN/TeGGidpBrDKucRSfxPdPq92jvDphAURhbWhoVF/6K?=
 =?us-ascii?Q?NW/ApUdIqtvSgnGRHLCRADaQO9fLiHVnByUyR6d/ruvGQtW/zxIV1O+lmayj?=
 =?us-ascii?Q?HCTKY+cnoxSTQMRFckEunZ+4I17p6es+VQrgdyZ/pRGxMhQTvJXIwWtKYY4I?=
 =?us-ascii?Q?CjhXy2NeSpE7kUDbW47BQKZD8c8/uR6vuYJclP89IdyaZRu6dYoEuHtxp7bJ?=
 =?us-ascii?Q?K47nldL2Bm+q1+MzX2BemveRoaSx67ccw/xzGfwP4W8heJWMydvBhh0VTc/D?=
 =?us-ascii?Q?NwGMpsRNec/+585dTzvNRwbkwierxmVb5Y1h+y6TBerfEBnYRy0u9gaL9MXA?=
 =?us-ascii?Q?xA=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 8518fdd1-673a-4e11-f9e5-08db8edb27a1
X-MS-Exchange-CrossTenant-AuthSource: PH8PR11MB8107.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2023 19:53:31.8407
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: aA8xaSocJVxuS4LmKLoGMHqjuVjdw3nO9Q1cA2Uoof3MrHMcRVwl8AS9zydDRb3Y4MgRwpKgGQLbWVFkTn1EBJq7W2GcYrRTMJrvWzaIxQI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR11MB6382
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,
        SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Bjorn Helgaas wrote:
> On Wed, Jul 26, 2023 at 11:29:42AM -0700, Ira Weiny wrote:
> > The following debug object splat was observed in testing.
> > 
> >   [   14.061937] ------------[ cut here ]------------
> >   [   14.063899] ODEBUG: free active (active state 0) object: 0000000097d23782 object type: work_struct hint: doe_statemachine_work+0x0/0x510
> >   [   14.067480] WARNING: CPU: 1 PID: 71 at lib/debugobjects.c:514 debug_print_object+0x7d/0xb0
> >   ...
> >   [   14.080951] Workqueue: pci 0000:36:00.0 DOE [1 doe_statemachine_work
> >   [   14.083485] RIP: 0010:debug_print_object+0x7d/0xb0
> >   ...
> >   [   14.116231] Call Trace:
> >   [   14.117652]  <TASK>
> >   [   14.118958]  ? debug_print_object+0x7d/0xb0
> >   [   14.120782]  ? __warn+0x7d/0x130
> >   [   14.122399]  ? debug_print_object+0x7d/0xb0
> >   [   14.123746]  ? report_bug+0x18d/0x1c0
> >   [   14.125025]  ? handle_bug+0x3c/0x80
> >   [   14.126506]  ? exc_invalid_op+0x13/0x60
> >   [   14.127796]  ? asm_exc_invalid_op+0x16/0x20
> >   [   14.129380]  ? debug_print_object+0x7d/0xb0
> >   [   14.130688]  ? debug_print_object+0x7d/0xb0
> >   [   14.131997]  ? __pfx_doe_statemachine_work+0x10/0x10
> >   [   14.133597]  debug_object_free.part.0+0x11b/0x150
> >   [   14.134940]  doe_statemachine_work+0x45e/0x510
> >   [   14.136348]  process_one_work+0x1d4/0x3c0
> >   ...
> >   [   14.161484]  </TASK>
> >   [   14.162434] ---[ end trace 0000000000000000 ]---
> > 
> > This occurs because destroy_work_on_stack() was called after signaling
> > the completion in the calling thread.  This creates a race between
> > destroy_work_on_stack() and the task->work struct going of scope in the
> > pci_doe().
> > 
> > Signal the work complete after destroying the work struct.  This is safe
> > because signal_task_complete() is the final thing the work item does and
> > the workqueue code is careful not to access the work struct after.
> > 
> > Fixes: abf04be0e707 ("PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y")
> > Cc: Lukas Wunner <lukas@wunner.de>
> > Signed-off-by: Ira Weiny <ira.weiny@intel.com>
> 
> Acked-by: Bjorn Helgaas <bhelgaas@google.com>
> Dan, let me know if you'd rather have me take this.

I have nothing else in the DOE area at this time, so I would be happy if
you took it. It is self contained to drivers/pci/.

Much appreciated.

Acked-by: Dan Williams <dan.j.williams@intel.com>