archive mirror
 help / color / mirror / Atom feed
From: Lukas Wunner <>
To: Bjorn Helgaas <>, David Hoyer <>
Cc: Keith Busch <>,,
	Xiongfeng Wang <>,
	Sergey Miroshnichenko <>
Subject: [PATCH] PCI: pciehp: Fix indefinite wait on sysfs requests
Date: Wed, 18 Mar 2020 12:33:12 +0100	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

David Hoyer reports that powering pciehp slots up or down via sysfs may
hang:  The call to wait_event() in pciehp_sysfs_enable_slot() and
_disable_slot() does not return because ctrl->ist_running remains true.

This flag, which was introduced by commit 54ecb8f7028c ("PCI: pciehp:
Avoid returning prematurely from sysfs requests"), signifies that the
IRQ thread pciehp_ist() is running.  It is set to true at the top of
pciehp_ist() and reset to false at the end.  However there are two
additional return statements in pciehp_ist() before which the commit
neglected to reset the flag to false and wake up waiters for the flag.

That omission opens up the following race when powering up the slot:

* pciehp_ist() runs because a PCI_EXP_SLTSTA_PDC event was requested
  by pciehp_sysfs_enable_slot()

* pciehp_ist() turns on slot power via the following call stack:
  pciehp_handle_presence_or_link_change() -> pciehp_enable_slot() ->
  __pciehp_enable_slot() -> board_added() -> pciehp_power_on_slot()

* after slot power is turned on, the link comes up, resulting in a

* the IRQ handler pciehp_isr() stores the event in ctrl->pending_events
  and returns IRQ_WAKE_THREAD

* the IRQ thread is already woken (it's bringing up the slot), but the
  genirq code remembers to re-run the IRQ thread after it has finished
  (such that it can deal with the new event) by setting IRQTF_RUNTHREAD
  via __handle_irq_event_percpu() -> __irq_wake_thread()

* the IRQ thread removes PCI_EXP_SLTSTA_DLLSC from ctrl->pending_events
  via board_added() -> pciehp_check_link_status() in order to deal with
  presence and link flaps per commit 6c35a1ac3da6 ("PCI: pciehp:
  Tolerate initially unstable link")

* after pciehp_ist() has successfully brought up the slot, it resets
  ctrl->ist_running to false and wakes up the sysfs requester

* the genirq code re-runs pciehp_ist(), which sets ctrl->ist_running
  to true but then returns with IRQ_NONE because ctrl->pending_events
  is empty

* pciehp_sysfs_enable_slot() is finally woken but notices that
  ctrl->ist_running is true, hence continues waiting

The only way to get the hung task going again is to trigger a hotplug
event which brings down the slot, e.g. by yanking out the card.

The same race exists when powering down the slot because remove_board()
likewise clears link or presence changes in ctrl->pending_events per
commit 3943af9d01e9 ("PCI: pciehp: Ignore Link State Changes after
powering off a slot") and thereby may cause a re-run of pciehp_ist()
which returns with IRQ_NONE without resetting ctrl->ist_running to false.

Fix by adding a goto label before the teardown steps at the end of
pciehp_ist() and jumping to that label from the two return statements
which currently neglect to reset the ctrl->ist_running flag.

Fixes: 54ecb8f7028c ("PCI: pciehp: Avoid returning prematurely from sysfs requests")
Reported-by: David Hoyer <>
Signed-off-by: Lukas Wunner <>
Cc: # v4.19+
Cc: Keith Busch <>
 drivers/pci/hotplug/pciehp_hpc.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index e4627c68b30f..5f1a27bfcb19 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -663,17 +663,15 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
 	if (atomic_fetch_and(~RERUN_ISR, &ctrl->pending_events) & RERUN_ISR) {
 		ret = pciehp_isr(irq, dev_id);
-		if (ret != IRQ_WAKE_THREAD) {
-			pci_config_pm_runtime_put(pdev);
-			return ret;
-		}
+		if (ret != IRQ_WAKE_THREAD)
+			goto out;
 	events = atomic_xchg(&ctrl->pending_events, 0);
 	if (!events) {
-		pci_config_pm_runtime_put(pdev);
-		return IRQ_NONE;
+		ret = IRQ_NONE;
+		goto out;
 	/* Check Attention Button Pressed */
@@ -702,10 +700,12 @@ static irqreturn_t pciehp_ist(int irq, void *dev_id)
 		pciehp_handle_presence_or_link_change(ctrl, events);
+	ret = IRQ_HANDLED;
 	ctrl->ist_running = false;
-	return IRQ_HANDLED;
+	return ret;
 static int pciehp_poll(void *data)

  parent reply	other threads:[~2020-03-18 11:39 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-03-14 14:19 Kernel hangs when powering up/down drive using sysfs Hoyer, David
2020-03-16 16:15 ` Keith Busch
2020-03-16 18:10   ` Lukas Wunner
2020-03-16 18:42     ` Keith Busch
2020-03-18 11:53       ` Lukas Wunner
2020-03-16 18:19 ` Lukas Wunner
2020-03-16 18:25   ` Hoyer, David
2020-03-16 21:35     ` Hoyer, David
2020-03-18 11:49     ` Lukas Wunner
2020-03-18 14:06       ` Hoyer, David
2020-03-18 11:33 ` Lukas Wunner [this message]
2020-03-18 16:43   ` [PATCH] PCI: pciehp: Fix indefinite wait on sysfs requests Keith Busch
2020-03-28 20:25   ` Bjorn Helgaas

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).