From: Thomas Gleixner <tglx@linutronix.de>
To: LKML <linux-kernel@vger.kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>,
Paul McKenney <paulmck@kernel.org>,
Matthew Wilcox <willy@infradead.org>,
Christian Benvenuti <benve@cisco.com>,
Govindarajulu Varadarajan <_govind@gmx.com>,
Dave Miller <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
netdev@vger.kernel.org, Jonathan Corbet <corbet@lwn.net>,
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
linux-doc@vger.kernel.org,
Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
Luc Van Oostenryck <luc.vanoostenryck@gmail.com>,
Jay Cliburn <jcliburn@gmail.com>,
Chris Snook <chris.snook@gmail.com>,
Vishal Kulkarni <vishal@chelsio.com>,
Jeff Kirsher <jeffrey.t.kirsher@intel.com>,
intel-wired-lan@lists.osuosl.org,
Shannon Nelson <snelson@pensando.io>,
Pensando Drivers <drivers@pensando.io>,
Andrew Lunn <andrew@lunn.ch>,
Heiner Kallweit <hkallweit1@gmail.com>,
Russell King <linux@armlinux.org.uk>,
Thomas Bogendoerfer <tsbogend@alpha.franken.de>,
Solarflare linux maintainers <linux-net-drivers@solarflare.com>,
Edward Cree <ecree@solarflare.com>,
Martin Habets <mhabets@solarflare.com>,
Jon Mason <jdmason@kudzu.us>, Daniel Drake <dsd@gentoo.org>,
Ulrich Kunitz <kune@deine-taler.de>,
Kalle Valo <kvalo@codeaurora.org>,
linux-wireless@vger.kernel.org, linux-usb@vger.kernel.org,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Arend van Spriel <arend.vanspriel@broadcom.com>,
Franky Lin <franky.lin@broadcom.com>,
Hante Meuleman <hante.meuleman@broadcom.com>,
Chi-Hsien Lin <chi-hsien.lin@cypress.com>,
Wright Feng <wright.feng@cypress.com>,
brcm80211-dev-list.pdl@broadcom.com,
brcm80211-dev-list@cypress.com,
Stanislav Yakovlev <stas.yakovlev@gmail.com>,
Stanislaw Gruszka <stf_xl@wp.pl>,
Johannes Berg <johannes.berg@intel.com>,
Emmanuel Grumbach <emmanuel.grumbach@intel.com>,
Luca Coelho <luciano.coelho@intel.com>,
Intel Linux Wireless <linuxwifi@intel.com>,
Jouni Malinen <j@w1.fi>, Amitkumar Karwar <amitkarwar@gmail.com>,
Ganapathi Bhat <ganapathi.bhat@nxp.com>,
Xinming Hu <huxinming820@gmail.com>,
libertas-dev@lists.infradead.org,
Pascal Terjan <pterjan@google.com>,
Ping-Ke Shih <pkshih@realtek.com>
Subject: [patch V2 01/36] net: enic: Cure the enic api locking trainwreck
Date: Tue, 29 Sep 2020 22:25:10 +0200 [thread overview]
Message-ID: <20200929203459.515312515@linutronix.de> (raw)
In-Reply-To: 20200929202509.673358734@linutronix.de
From: Thomas Gleixner <tglx@linutronix.de>
enic_dev_wait() has a BUG_ON(in_interrupt()).
Chasing the callers of enic_dev_wait() revealed the gems of enic_reset()
and enic_tx_hang_reset() which are both invoked through work queues in
order to be able to call rtnl_lock(). So far so good.
After locking rtnl both functions acquire enic::enic_api_lock which
serializes against the (ab)use from infiniband. This is where the
trainwreck starts.
enic::enic_api_lock is a spin_lock() which implicitly disables preemption,
but both functions invoke a ton of functions under that lock which can
sleep. The BUG_ON(in_interrupt()) does not trigger in that case because it
can't detect the preempt disabled condition.
This clearly has never been tested with any of the mandatory debug options
for 7+ years, which would have caught that for sure.
Cure it by adding a enic_api_busy member to struct enic, which is modified
and evaluated with enic::enic_api_lock held.
If enic_api_devcmd_proxy_by_index() observes enic::enic_api_busy as true,
it drops enic::enic_api_lock and busy waits for enic::enic_api_busy to
become false.
It would be smarter to wait for a completion of that busy period, but
enic_api_devcmd_proxy_by_index() is called with other spin locks held which
obviously can't sleep.
Remove the BUG_ON(in_interrupt()) check as well because it's incomplete and
with proper debugging enabled the problem would have been caught from the
debug checks in schedule_timeout().
Fixes: 0b038566c0ea ("drivers/net: enic: Add an interface for USNIC to interact with firmware")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
---
V2: Cure tglx's last minute rename fail
---
drivers/net/ethernet/cisco/enic/enic.h | 1 +
drivers/net/ethernet/cisco/enic/enic_api.c | 6 ++++++
drivers/net/ethernet/cisco/enic/enic_main.c | 27 +++++++++++++++++++++------
3 files changed, 28 insertions(+), 6 deletions(-)
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -169,6 +169,7 @@ struct enic {
u16 num_vfs;
#endif
spinlock_t enic_api_lock;
+ bool enic_api_busy;
struct enic_port_profile *pp;
/* work queue cache line section */
--- a/drivers/net/ethernet/cisco/enic/enic_api.c
+++ b/drivers/net/ethernet/cisco/enic/enic_api.c
@@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struc
struct vnic_dev *vdev = enic->vdev;
spin_lock(&enic->enic_api_lock);
+ while (enic->enic_api_busy) {
+ spin_unlock(&enic->enic_api_lock);
+ cpu_relax();
+ spin_lock(&enic->enic_api_lock);
+ }
+
spin_lock_bh(&enic->devcmd_lock);
vnic_dev_cmd_proxy_by_index_start(vdev, vf);
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2107,8 +2107,6 @@ static int enic_dev_wait(struct vnic_dev
int done;
int err;
- BUG_ON(in_interrupt());
-
err = start(vdev, arg);
if (err)
return err;
@@ -2297,6 +2295,13 @@ static int enic_set_rss_nic_cfg(struct e
rss_hash_bits, rss_base_cpu, rss_enable);
}
+static void enic_set_api_busy(struct enic *enic, bool busy)
+{
+ spin_lock(&enic->enic_api_lock);
+ enic->enic_api_busy = busy;
+ spin_unlock(&enic->enic_api_lock);
+}
+
static void enic_reset(struct work_struct *work)
{
struct enic *enic = container_of(work, struct enic, reset);
@@ -2306,7 +2311,9 @@ static void enic_reset(struct work_struc
rtnl_lock();
- spin_lock(&enic->enic_api_lock);
+ /* Stop any activity from infiniband */
+ enic_set_api_busy(enic, true);
+
enic_stop(enic->netdev);
enic_dev_soft_reset(enic);
enic_reset_addr_lists(enic);
@@ -2314,7 +2321,10 @@ static void enic_reset(struct work_struc
enic_set_rss_nic_cfg(enic);
enic_dev_set_ig_vlan_rewrite_mode(enic);
enic_open(enic->netdev);
- spin_unlock(&enic->enic_api_lock);
+
+ /* Allow infiniband to fiddle with the device again */
+ enic_set_api_busy(enic, false);
+
call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev);
rtnl_unlock();
@@ -2326,7 +2336,9 @@ static void enic_tx_hang_reset(struct wo
rtnl_lock();
- spin_lock(&enic->enic_api_lock);
+ /* Stop any activity from infiniband */
+ enic_set_api_busy(enic, true);
+
enic_dev_hang_notify(enic);
enic_stop(enic->netdev);
enic_dev_hang_reset(enic);
@@ -2335,7 +2347,10 @@ static void enic_tx_hang_reset(struct wo
enic_set_rss_nic_cfg(enic);
enic_dev_set_ig_vlan_rewrite_mode(enic);
enic_open(enic->netdev);
- spin_unlock(&enic->enic_api_lock);
+
+ /* Allow infiniband to fiddle with the device again */
+ enic_set_api_busy(enic, false);
+
call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev);
rtnl_unlock();
next prev parent reply other threads:[~2020-09-29 20:35 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-29 20:25 [patch V2 00/36] net: in_interrupt() cleanup and fixes Thomas Gleixner
2020-09-29 20:25 ` Thomas Gleixner [this message]
2020-09-29 20:25 ` [patch V2 02/36] net: caif: Remove unused caif SPI driver Thomas Gleixner
2020-09-29 20:25 ` [patch V2 03/36] net: Add netif_rx_any_context() Thomas Gleixner
2020-09-29 20:25 ` [patch V2 04/36] net: caif: Use netif_rx_any_context() Thomas Gleixner
2020-09-29 20:25 ` [patch V2 05/36] net: atheros: Remove WARN_ON(in_interrupt()) Thomas Gleixner
2020-09-29 20:25 ` [patch V2 06/36] net: cxgb3: Cleanup in_interrupt() usage Thomas Gleixner
2020-09-29 20:25 ` [patch V2 07/36] net: cxbg4: Remove pointless in_interrupt() check Thomas Gleixner
2020-09-29 20:25 ` [patch V2 08/36] net: e100: Remove in_interrupt() usage and pointless GFP_ATOMIC allocation Thomas Gleixner
2020-09-29 20:25 ` [patch V2 09/36] net: fec_mpc52xx: Replace in_interrupt() usage Thomas Gleixner
2020-09-29 20:25 ` [patch V2 10/36] net: intel: Remove in_interrupt() warnings Thomas Gleixner
2020-09-29 20:25 ` [patch V2 11/36] net: ionic: Replace in_interrupt() usage Thomas Gleixner
2020-09-29 23:06 ` Shannon Nelson
2020-09-29 20:25 ` [patch V2 12/36] net: ionic: Remove WARN_ON(in_interrupt()) Thomas Gleixner
2020-09-29 20:25 ` [patch V2 13/36] net: mdiobus: Remove WARN_ON_ONCE(in_interrupt()) Thomas Gleixner
2020-09-29 20:25 ` [patch V2 14/36] net: natsemi: Replace in_interrupt() usage Thomas Gleixner
2020-09-29 20:25 ` [patch V2 15/36] net: sfc: " Thomas Gleixner
2020-09-29 20:25 ` [patch V2 16/36] net: sfc: Use GFP_KERNEL in efx_ef10_try_update_nic_stats() Thomas Gleixner
2020-09-30 8:00 ` Martin Habets
2020-09-29 20:25 ` [patch V2 17/36] net: sunbmac: Replace in_interrupt() usage Thomas Gleixner
2020-09-29 20:25 ` [patch V2 18/36] net: sun3lance: Remove redundant checks in interrupt handler Thomas Gleixner
2020-09-29 20:25 ` [patch V2 19/36] net: vxge: Remove in_interrupt() conditionals Thomas Gleixner
2020-09-29 20:25 ` [patch V2 20/36] net: zd1211rw: Remove ZD_ASSERT(in_interrupt()) Thomas Gleixner
2020-09-29 20:25 ` [patch V2 21/36] net: usb: kaweth: Replace kaweth_control() with usb_control_msg() Thomas Gleixner
2020-09-30 6:22 ` Greg Kroah-Hartman
2020-09-29 20:25 ` [patch V2 22/36] net: usb: kaweth: Remove last user of kaweth_control() Thomas Gleixner
2020-09-29 20:25 ` [patch V2 23/36] net: usb: net1080: Remove in_interrupt() comment Thomas Gleixner
2020-09-29 20:25 ` [patch V2 24/36] net: wan/lmc: Remove lmc_trace() Thomas Gleixner
2020-09-29 20:25 ` [patch V2 25/36] net: brcmfmac: Replace in_interrupt() Thomas Gleixner
2020-09-29 20:25 ` [patch V2 26/36] net: brcmfmac: Convey execution context via argument to brcmf_netif_rx() Thomas Gleixner
2020-09-29 22:03 ` Arend Van Spriel
2020-09-29 20:25 ` [patch V2 27/36] net: brcmfmac: Convey allocation mode as argument Thomas Gleixner
2020-09-29 22:07 ` Arend Van Spriel
2020-09-29 20:25 ` [patch V2 28/36] net: ipw2x00,iwlegacy,iwlwifi: Remove in_interrupt() from debug macros Thomas Gleixner
2020-09-29 20:25 ` [patch V2 29/36] net: iwlwifi: Remove in_interrupt() from tracing macro Thomas Gleixner
2020-09-29 20:25 ` [patch V2 30/36] net: hostap: Remove in_interrupt() usage Thomas Gleixner
2020-09-29 20:25 ` [patch V2 31/36] net: mwifiex: Use netif_rx_any_context() Thomas Gleixner
2020-09-29 20:25 ` [patch V2 32/36] net: libertas libertas_tf: Remove in_interrupt() from debug macro Thomas Gleixner
2020-09-29 20:25 ` [patch V2 33/36] net: libertas: Use netif_rx_any_context() Thomas Gleixner
2020-09-29 21:53 ` James Cameron
2020-09-29 20:25 ` [patch V2 34/36] net: rtlwifi: Remove void* casts related to delayed work Thomas Gleixner
2020-09-29 20:25 ` [patch V2 35/36] net: rtlwifi: Remove in_interrupt() from debug macro Thomas Gleixner
2020-09-29 20:25 ` [patch V2 36/36] net: rtlwifi: Replace in_interrupt() for context detection Thomas Gleixner
2020-09-29 21:22 ` [patch V2 00/36] net: in_interrupt() cleanup and fixes David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200929203459.515312515@linutronix.de \
--to=tglx@linutronix.de \
--cc=_govind@gmx.com \
--cc=amitkarwar@gmail.com \
--cc=andrew@lunn.ch \
--cc=arend.vanspriel@broadcom.com \
--cc=benve@cisco.com \
--cc=bigeasy@linutronix.de \
--cc=brcm80211-dev-list.pdl@broadcom.com \
--cc=brcm80211-dev-list@cypress.com \
--cc=chi-hsien.lin@cypress.com \
--cc=chris.snook@gmail.com \
--cc=corbet@lwn.net \
--cc=davem@davemloft.net \
--cc=drivers@pensando.io \
--cc=dsd@gentoo.org \
--cc=ecree@solarflare.com \
--cc=emmanuel.grumbach@intel.com \
--cc=franky.lin@broadcom.com \
--cc=ganapathi.bhat@nxp.com \
--cc=gregkh@linuxfoundation.org \
--cc=hante.meuleman@broadcom.com \
--cc=hkallweit1@gmail.com \
--cc=huxinming820@gmail.com \
--cc=intel-wired-lan@lists.osuosl.org \
--cc=j@w1.fi \
--cc=jcliburn@gmail.com \
--cc=jdmason@kudzu.us \
--cc=jeffrey.t.kirsher@intel.com \
--cc=johannes.berg@intel.com \
--cc=kuba@kernel.org \
--cc=kune@deine-taler.de \
--cc=kvalo@codeaurora.org \
--cc=libertas-dev@lists.infradead.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-net-drivers@solarflare.com \
--cc=linux-usb@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=linuxwifi@intel.com \
--cc=luc.vanoostenryck@gmail.com \
--cc=luciano.coelho@intel.com \
--cc=mchehab+huawei@kernel.org \
--cc=mhabets@solarflare.com \
--cc=netdev@vger.kernel.org \
--cc=paulmck@kernel.org \
--cc=peterz@infradead.org \
--cc=pkshih@realtek.com \
--cc=pterjan@google.com \
--cc=snelson@pensando.io \
--cc=stas.yakovlev@gmail.com \
--cc=stf_xl@wp.pl \
--cc=tsbogend@alpha.franken.de \
--cc=vishal@chelsio.com \
--cc=willy@infradead.org \
--cc=wright.feng@cypress.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).