cxl: Prevent read/write to AFU config space while AFU not configured

During EEH recovery, we deconfigure all AFUs whilst leaving the
corresponding vPHB and virtual PCI device in place.

If something attempts to interact with the AFU's PCI config space (e.g.
running lspci) after the AFU has been deconfigured and before it's
reconfigured, cxl_pcie_{read,write}_config() will read invalid values from
the deconfigured struct cxl_afu and proceed to Oops when they try to
dereference pointers that have been set to NULL during deconfiguration.

Add a rwsem to struct cxl_afu so we can prevent interaction with config
space while the AFU is deconfigured.

Reported-by: Pradipta Ghosh <pradghos@in.ibm.com>
Suggested-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>

diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
index b24d76723fb0900b2588fa0a8f192ca9174ad199..b4a43fd14b99b3bc5a2fc7fab538a94b2bebf31f 100644 (file)
--- a/drivers/misc/cxl/cxl.h
+++ b/drivers/misc/cxl/cxl.h
@@ -418,6 +418,8 @@ struct cxl_afu {
        struct dentry *debugfs;
        struct mutex contexts_lock;
        spinlock_t afu_cntl_lock;
+       /* Used to block access to AFU config space while deconfigured */
+       struct rw_semaphore configured_rwsem;
 
        /* AFU error buffer fields and bin attribute for sysfs */
        u64 eb_len, eb_offset;

diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
index 62e0dfb5f15b62d64980bb008d448038f8fd3c36..2a6bf1d0a3a4f9ae2ffb2f083915df18fd4372dc 100644 (file)
--- a/drivers/misc/cxl/main.c
+++ b/drivers/misc/cxl/main.c
@@ -268,7 +268,8 @@ struct cxl_afu *cxl_alloc_afu(struct cxl *adapter, int slice)
        idr_init(&afu->contexts_idr);
        mutex_init(&afu->contexts_lock);
        spin_lock_init(&afu->afu_cntl_lock);
-
+       init_rwsem(&afu->configured_rwsem);
+       down_write(&afu->configured_rwsem);
        afu->prefault_mode = CXL_PREFAULT_NONE;
        afu->irqs_max = afu->adapter->user_irqs;
 

diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index 73432e7d925d049a4db3a1490d4e0fcef19c90c4..cca938845ffdd2534f0fc7ebe29ff86d2fb7695b 100644 (file)
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -1129,6 +1129,7 @@ static int pci_configure_afu(struct cxl_afu *afu, struct cxl *adapter, struct pc
        if ((rc = cxl_native_register_psl_irq(afu)))
                goto err2;
 
+       up_write(&afu->configured_rwsem);
        return 0;
 
 err2:
@@ -1141,6 +1142,7 @@ err1:
 
 static void pci_deconfigure_afu(struct cxl_afu *afu)
 {
+       down_write(&afu->configured_rwsem);
        cxl_native_release_psl_irq(afu);
        if (afu->adapter->native->sl_ops->release_serr_irq)
                afu->adapter->native->sl_ops->release_serr_irq(afu);

diff --git a/drivers/misc/cxl/vphb.c b/drivers/misc/cxl/vphb.c
index 3519acebfdab6be8387151d969f55859952c2f09..639a343b7836a49f4da124fcdae68bf3dad96c6c 100644 (file)
--- a/drivers/misc/cxl/vphb.c
+++ b/drivers/misc/cxl/vphb.c
@@ -76,23 +76,22 @@ static int cxl_pcie_cfg_record(u8 bus, u8 devfn)
        return (bus << 8) + devfn;
 }
 
-static int cxl_pcie_config_info(struct pci_bus *bus, unsigned int devfn,
-                               struct cxl_afu **_afu, int *_record)
+static inline struct cxl_afu *pci_bus_to_afu(struct pci_bus *bus)
 {
-       struct pci_controller *phb;
-       struct cxl_afu *afu;
-       int record;
+       struct pci_controller *phb = bus ? pci_bus_to_host(bus) : NULL;
 
-       phb = pci_bus_to_host(bus);
-       if (phb == NULL)
-               return PCIBIOS_DEVICE_NOT_FOUND;
+       return phb ? phb->private_data : NULL;
+}
+
+static inline int cxl_pcie_config_info(struct pci_bus *bus, unsigned int devfn,
+                                      struct cxl_afu *afu, int *_record)
+{
+       int record;
 
-       afu = (struct cxl_afu *)phb->private_data;
        record = cxl_pcie_cfg_record(bus->number, devfn);
        if (record > afu->crs_num)
                return PCIBIOS_DEVICE_NOT_FOUND;
 
-       *_afu = afu;
        *_record = record;
        return 0;
 }
@@ -106,9 +105,14 @@ static int cxl_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
        u16 val16;
        u32 val32;
 
-       rc = cxl_pcie_config_info(bus, devfn, &afu, &record);
+       afu = pci_bus_to_afu(bus);
+       /* Grab a reader lock on afu. */
+       if (afu == NULL || !down_read_trylock(&afu->configured_rwsem))
+               return PCIBIOS_DEVICE_NOT_FOUND;
+
+       rc = cxl_pcie_config_info(bus, devfn, afu, &record);
        if (rc)
-               return rc;
+               goto out;
 
        switch (len) {
        case 1:
@@ -127,10 +131,9 @@ static int cxl_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
                WARN_ON(1);
        }
 
-       if (rc)
-               return PCIBIOS_DEVICE_NOT_FOUND;
-
-       return PCIBIOS_SUCCESSFUL;
+out:
+       up_read(&afu->configured_rwsem);
+       return rc ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
 }
 
 static int cxl_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
@@ -139,9 +142,14 @@ static int cxl_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
        int rc, record;
        struct cxl_afu *afu;
 
-       rc = cxl_pcie_config_info(bus, devfn, &afu, &record);
+       afu = pci_bus_to_afu(bus);
+       /* Grab a reader lock on afu. */
+       if (afu == NULL || !down_read_trylock(&afu->configured_rwsem))
+               return PCIBIOS_DEVICE_NOT_FOUND;
+
+       rc = cxl_pcie_config_info(bus, devfn, afu, &record);
        if (rc)
-               return rc;
+               goto out;
 
        switch (len) {
        case 1:
@@ -157,10 +165,9 @@ static int cxl_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
                WARN_ON(1);
        }
 
-       if (rc)
-               return PCIBIOS_SET_FAILED;
-
-       return PCIBIOS_SUCCESSFUL;
+out:
+       up_read(&afu->configured_rwsem);
+       return rc ? PCIBIOS_SET_FAILED : PCIBIOS_SUCCESSFUL;
 }
 
 static struct pci_ops cxl_pcie_pci_ops =