Commit f57aec44 authored by Dan Williams's avatar Dan Williams
Browse files

cxl/pmem: Fix nvdimm registration races 



A loop of the form:

    while true; do modprobe cxl_pci; modprobe -r cxl_pci; done

...fails with the following crash signature:

    BUG: kernel NULL pointer dereference, address: 0000000000000040
    [..]
    RIP: 0010:cxl_internal_send_cmd+0x5/0xb0 [cxl_core]
    [..]
    Call Trace:
     <TASK>
     cxl_pmem_ctl+0x121/0x240 [cxl_pmem]
     nvdimm_get_config_data+0xd6/0x1a0 [libnvdimm]
     nd_label_data_init+0x135/0x7e0 [libnvdimm]
     nvdimm_probe+0xd6/0x1c0 [libnvdimm]
     nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm]
     really_probe+0xde/0x380
     __driver_probe_device+0x78/0x170
     driver_probe_device+0x1f/0x90
     __device_attach_driver+0x85/0x110
     bus_for_each_drv+0x7d/0xc0
     __device_attach+0xb4/0x1e0
     bus_probe_device+0x9f/0xc0
     device_add+0x445/0x9c0
     nd_async_device_register+0xe/0x40 [libnvdimm]
     async_run_entry_fn+0x30/0x130

...namely that the bottom half of async nvdimm device registration runs
after the CXL has already torn down the context that cxl_pmem_ctl()
needs. Unlike the ACPI NFIT case that benefits from launching multiple
nvdimm device registrations in parallel from those listed in the table,
CXL is already marked PROBE_PREFER_ASYNCHRONOUS. So provide for a
synchronous registration path to preclude this scenario.

Fixes: 21083f51 ("cxl/pmem: Register 'pmem' / cxl_nvdimm devices")
Cc: <stable@vger.kernel.org>
Reported-by: default avatarDave Jiang <dave.jiang@intel.com>
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
parent b8b9ffce

drivers/cxl/pmem.c

+1 −0
Original line number Diff line number Diff line
@@ -76,6 +76,7 @@ static int cxl_nvdimm_probe(struct device *dev) 
		return rc;



	set_bit(NDD_LABELING, &flags);

	set_bit(NDD_REGISTER_SYNC, &flags);

	set_bit(ND_CMD_GET_CONFIG_SIZE, &cmd_mask);

	set_bit(ND_CMD_GET_CONFIG_DATA, &cmd_mask);

	set_bit(ND_CMD_SET_CONFIG_DATA, &cmd_mask);

drivers/nvdimm/bus.c

+16 −3
Original line number Diff line number Diff line
@@ -508,7 +508,7 @@ static void nd_async_device_unregister(void *d, async_cookie_t cookie) 
	put_device(dev);

}



void nd_device_register(struct device *dev)

static void __nd_device_register(struct device *dev, bool sync)

{

	if (!dev)

		return;
@@ -531,11 +531,24 @@ void nd_device_register(struct device *dev) 
	}

	get_device(dev);



	if (sync)

		nd_async_device_register(dev, 0);

	else

		async_schedule_dev_domain(nd_async_device_register, dev,

					  &nd_async_domain);

}



void nd_device_register(struct device *dev)

{

	__nd_device_register(dev, false);

}

EXPORT_SYMBOL(nd_device_register);



void nd_device_register_sync(struct device *dev)

{

	__nd_device_register(dev, true);

}



void nd_device_unregister(struct device *dev, enum nd_async_mode mode)

{

	bool killed;

drivers/nvdimm/dimm_devs.c

+4 −1
Original line number Diff line number Diff line
@@ -624,6 +624,9 @@ struct nvdimm *__nvdimm_create(struct nvdimm_bus *nvdimm_bus, 
	nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER);

	device_initialize(dev);

	lockdep_set_class(&dev->mutex, &nvdimm_key);

	if (test_bit(NDD_REGISTER_SYNC, &flags))

		nd_device_register_sync(dev);

	else

		nd_device_register(dev);



	return nvdimm;

drivers/nvdimm/nd-core.h

+1 −0
Original line number Diff line number Diff line
@@ -107,6 +107,7 @@ int nvdimm_bus_create_ndctl(struct nvdimm_bus *nvdimm_bus); 
void nvdimm_bus_destroy_ndctl(struct nvdimm_bus *nvdimm_bus);

void nd_synchronize(void);

void nd_device_register(struct device *dev);

void nd_device_register_sync(struct device *dev);

struct nd_label_id;

char *nd_label_gen_id(struct nd_label_id *label_id, const uuid_t *uuid,

		      u32 flags);

include/linux/libnvdimm.h

+3 −0
Original line number Diff line number Diff line
@@ -41,6 +41,9 @@ enum { 
	 */

	NDD_INCOHERENT = 7,



	/* dimm provider wants synchronous registration by __nvdimm_create() */

	NDD_REGISTER_SYNC = 8,



	/* need to set a limit somewhere, but yes, this is likely overkill */

	ND_IOCTL_MAX_BUFLEN = SZ_4M,

	ND_CMD_MAX_ELEM = 5,