There are a couple of issues in qat error handling. Those drivers tries to
release resources that is not initialized. This patch series tries to fix
crashes caused by incorrect error handling.
v2: removed excessive dump in commit log as suggested by Andy Shevchenko <[email protected]>
v3: collect tags as suggested by Andy Shevchenko <[email protected]>
Tong Zhang (2):
crypto: qat - dont release uninitialized resources
crypto: qat: ADF_STATUS_PF_RUNNING should be set after adf_dev_init
drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++--
drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++--
drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +++++++++++++----
drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++--
4 files changed, 19 insertions(+), 10 deletions(-)
--
2.25.1
adf_vf_isr_resource_alloc() is not unwinding correctly when error
happens and it trys to release uninitialized resources.
To fix this, only release initialized resources.
[ 1.792845] Trying to free already-free IRQ 11
[ 1.793091] WARNING: CPU: 0 PID: 182 at kernel/irq/manage.c:1821 free_irq+0x202/0x380
[ 1.801340] Call Trace:
[ 1.801477] adf_vf_isr_resource_free+0x32/0xb0 [intel_qat]
[ 1.801785] adf_vf_isr_resource_alloc+0x14d/0x150 [intel_qat]
[ 1.802105] adf_dev_init+0xba/0x140 [intel_qat]
Signed-off-by: Tong Zhang <[email protected]>
Reviewed-by: Andy Shevchenko <[email protected]>
---
drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
index 38d316a42ba6..888388acb6bd 100644
--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
@@ -261,17 +261,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
goto err_out;
if (adf_setup_pf2vf_bh(accel_dev))
- goto err_out;
+ goto err_disable_msi;
if (adf_setup_bh(accel_dev))
- goto err_out;
+ goto err_cleanup_pf2vf_bh;
if (adf_request_msi_irq(accel_dev))
- goto err_out;
+ goto err_cleanup_bh;
return 0;
+
+err_cleanup_bh:
+ adf_cleanup_bh(accel_dev);
+
+err_cleanup_pf2vf_bh:
+ adf_cleanup_pf2vf_bh(accel_dev);
+
+err_disable_msi:
+ adf_disable_msi(accel_dev);
+
err_out:
- adf_vf_isr_resource_free(accel_dev);
return -EFAULT;
}
EXPORT_SYMBOL_GPL(adf_vf_isr_resource_alloc);
--
2.25.1
ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown()
before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the
vf2pf_lock is initialized in adf_dev_init(), which can fail and when it
fail, the vf2pf_lock is either not initialized or destroyed, a subsequent
use of vf2pf_lock will cause issue.
To fix this issue, only set this flag if adf_dev_init() returns 0.
[ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0
[ 7.180345] Call Trace:
[ 7.182576] mutex_lock+0xc9/0xd0
[ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat]
[ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat]
[ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat]
[ 7.184127] adf_probe+0x5e9/0x600 [qat_dh895xccvf]
Signed-off-by: Tong Zhang <[email protected]>
Reviewed-by: Andy Shevchenko <[email protected]>
---
drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++--
drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++--
drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++--
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
index 1d1532e8fb6d..067ca5e17d38 100644
--- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
+++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
@@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
if (ret)
goto out_err_free_reg;
- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
-
ret = adf_dev_init(accel_dev);
if (ret)
goto out_err_dev_shutdown;
+ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+
ret = adf_dev_start(accel_dev);
if (ret)
goto out_err_dev_stop;
diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
index 04742a6d91ca..51ea88c0b17d 100644
--- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c
+++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
@@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
if (ret)
goto out_err_free_reg;
- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
-
ret = adf_dev_init(accel_dev);
if (ret)
goto out_err_dev_shutdown;
+ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+
ret = adf_dev_start(accel_dev);
if (ret)
goto out_err_dev_stop;
diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
index c972554a755e..29999da716cc 100644
--- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
+++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
@@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
if (ret)
goto out_err_free_reg;
- set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
-
ret = adf_dev_init(accel_dev);
if (ret)
goto out_err_dev_shutdown;
+ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+
ret = adf_dev_start(accel_dev);
if (ret)
goto out_err_dev_stop;
--
2.25.1
On Fri, Mar 12, 2021 at 11:22:02AM -0500, Tong Zhang wrote:
> adf_vf_isr_resource_alloc() is not unwinding correctly when error
> happens and it trys to release uninitialized resources.
> To fix this, only release initialized resources.
>
> [ 1.792845] Trying to free already-free IRQ 11
> [ 1.793091] WARNING: CPU: 0 PID: 182 at kernel/irq/manage.c:1821 free_irq+0x202/0x380
> [ 1.801340] Call Trace:
> [ 1.801477] adf_vf_isr_resource_free+0x32/0xb0 [intel_qat]
> [ 1.801785] adf_vf_isr_resource_alloc+0x14d/0x150 [intel_qat]
> [ 1.802105] adf_dev_init+0xba/0x140 [intel_qat]
>
> Signed-off-by: Tong Zhang <[email protected]>
> Reviewed-by: Andy Shevchenko <[email protected]>
I would add also a Fixes tag:
Fixes: dd0f368398ea ("crypto: qat - Add qat dh895xcc VF driver")
Minor nit, typo in commit message: dont --> don't/do not
Apart from that
Acked-by: Giovanni Cabiddu <[email protected]>
--
Giovanni
> ---
> drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +++++++++++++----
> 1 file changed, 13 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
> index 38d316a42ba6..888388acb6bd 100644
> --- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
> +++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
> @@ -261,17 +261,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
> goto err_out;
>
> if (adf_setup_pf2vf_bh(accel_dev))
> - goto err_out;
> + goto err_disable_msi;
>
> if (adf_setup_bh(accel_dev))
> - goto err_out;
> + goto err_cleanup_pf2vf_bh;
>
> if (adf_request_msi_irq(accel_dev))
> - goto err_out;
> + goto err_cleanup_bh;
>
> return 0;
> +
> +err_cleanup_bh:
> + adf_cleanup_bh(accel_dev);
> +
> +err_cleanup_pf2vf_bh:
> + adf_cleanup_pf2vf_bh(accel_dev);
> +
> +err_disable_msi:
> + adf_disable_msi(accel_dev);
> +
> err_out:
> - adf_vf_isr_resource_free(accel_dev);
> return -EFAULT;
> }
> EXPORT_SYMBOL_GPL(adf_vf_isr_resource_alloc);
> --
> 2.25.1
>
On Fri, Mar 12, 2021 at 11:22:03AM -0500, Tong Zhang wrote:
> ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown()
> before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the
> vf2pf_lock is initialized in adf_dev_init(), which can fail and when it
> fail, the vf2pf_lock is either not initialized or destroyed, a subsequent
> use of vf2pf_lock will cause issue.
> To fix this issue, only set this flag if adf_dev_init() returns 0.
>
> [ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0
> [ 7.180345] Call Trace:
> [ 7.182576] mutex_lock+0xc9/0xd0
> [ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat]
> [ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat]
> [ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat]
> [ 7.184127] adf_probe+0x5e9/0x600 [qat_dh895xccvf]
>
> Signed-off-by: Tong Zhang <[email protected]>
> Reviewed-by: Andy Shevchenko <[email protected]>
Fixes: 25c6ffb249f6 ("crypto: qat - check if PF is running")
Acked-by: Giovanni Cabiddu <[email protected]>
> ---
> drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++--
> drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++--
> drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++--
> 3 files changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
> index 1d1532e8fb6d..067ca5e17d38 100644
> --- a/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
> +++ b/drivers/crypto/qat/qat_c3xxxvf/adf_drv.c
> @@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> if (ret)
> goto out_err_free_reg;
>
> - set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
> -
> ret = adf_dev_init(accel_dev);
> if (ret)
> goto out_err_dev_shutdown;
>
> + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
> +
> ret = adf_dev_start(accel_dev);
> if (ret)
> goto out_err_dev_stop;
> diff --git a/drivers/crypto/qat/qat_c62xvf/adf_drv.c b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
> index 04742a6d91ca..51ea88c0b17d 100644
> --- a/drivers/crypto/qat/qat_c62xvf/adf_drv.c
> +++ b/drivers/crypto/qat/qat_c62xvf/adf_drv.c
> @@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> if (ret)
> goto out_err_free_reg;
>
> - set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
> -
> ret = adf_dev_init(accel_dev);
> if (ret)
> goto out_err_dev_shutdown;
>
> + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
> +
> ret = adf_dev_start(accel_dev);
> if (ret)
> goto out_err_dev_stop;
> diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
> index c972554a755e..29999da716cc 100644
> --- a/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
> +++ b/drivers/crypto/qat/qat_dh895xccvf/adf_drv.c
> @@ -184,12 +184,12 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
> if (ret)
> goto out_err_free_reg;
>
> - set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
> -
> ret = adf_dev_init(accel_dev);
> if (ret)
> goto out_err_dev_shutdown;
>
> + set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
> +
> ret = adf_dev_start(accel_dev);
> if (ret)
> goto out_err_dev_stop;
> --
> 2.25.1
>
On Thu, Mar 18, 2021 at 03:53:03PM +0000, Giovanni Cabiddu wrote:
> On Fri, Mar 12, 2021 at 11:22:02AM -0500, Tong Zhang wrote:
> > adf_vf_isr_resource_alloc() is not unwinding correctly when error
> > happens and it trys to release uninitialized resources.
^^^^
Typo: perhaps 'tries'?
Regards,
--
Giovanni
There are a couple of issues in qat error handling. Those drivers tries to
release resources that is not initialized. This patch series tries to fix
crashes caused by incorrect error handling.
v2: removed excessive dump in commit log as suggested by Andy Shevchenko <[email protected]>
v3: collect tags as suggested by Andy Shevchenko <[email protected]>
v4: fix commit log typos
Tong Zhang (2):
crypto: qat - dont release uninitialized resources
crypto: qat: ADF_STATUS_PF_RUNNING should be set after adf_dev_init
drivers/crypto/qat/qat_c3xxxvf/adf_drv.c | 4 ++--
drivers/crypto/qat/qat_c62xvf/adf_drv.c | 4 ++--
drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +++++++++++++----
drivers/crypto/qat/qat_dh895xccvf/adf_drv.c | 4 ++--
4 files changed, 19 insertions(+), 10 deletions(-)
--
2.25.1
adf_vf_isr_resource_alloc() is not unwinding correctly when error
happens and it tris to release uninitialized resources.
To fix this, only release initialized resources.
[ 1.792845] Trying to free already-free IRQ 11
[ 1.793091] WARNING: CPU: 0 PID: 182 at kernel/irq/manage.c:1821 free_irq+0x202/0x380
[ 1.801340] Call Trace:
[ 1.801477] adf_vf_isr_resource_free+0x32/0xb0 [intel_qat]
[ 1.801785] adf_vf_isr_resource_alloc+0x14d/0x150 [intel_qat]
[ 1.802105] adf_dev_init+0xba/0x140 [intel_qat]
Signed-off-by: Tong Zhang <[email protected]>
Reviewed-by: Andy Shevchenko <[email protected]>
Fixes: dd0f368398ea ("crypto: qat - Add qat dh895xcc VF driver")
Acked-by: Giovanni Cabiddu <[email protected]>
---
drivers/crypto/qat/qat_common/adf_vf_isr.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
index 38d316a42ba6..888388acb6bd 100644
--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
@@ -261,17 +261,26 @@ int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev)
goto err_out;
if (adf_setup_pf2vf_bh(accel_dev))
- goto err_out;
+ goto err_disable_msi;
if (adf_setup_bh(accel_dev))
- goto err_out;
+ goto err_cleanup_pf2vf_bh;
if (adf_request_msi_irq(accel_dev))
- goto err_out;
+ goto err_cleanup_bh;
return 0;
+
+err_cleanup_bh:
+ adf_cleanup_bh(accel_dev);
+
+err_cleanup_pf2vf_bh:
+ adf_cleanup_pf2vf_bh(accel_dev);
+
+err_disable_msi:
+ adf_disable_msi(accel_dev);
+
err_out:
- adf_vf_isr_resource_free(accel_dev);
return -EFAULT;
}
EXPORT_SYMBOL_GPL(adf_vf_isr_resource_alloc);
--
2.25.1
Thanks!
I have fixed typos and resent them as v4.
- Tong