Commit ffb1028a authored by Alexandra Winter's avatar Alexandra Winter Committed by Guo Mengqi
Browse files

s390/qeth: fix deadlock during failing recovery 

mainline inclusion
from mainline-v5.15-rc3
commit d2b59bd4
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4P3
CVE: CVE-2021-47382

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d2b59bd4b06d84a4eadb520b0f71c62fe8ec0a62



--------------------------------

Commit 0b9902c1 ("s390/qeth: fix deadlock during recovery") removed
taking discipline_mutex inside qeth_do_reset(), fixing potential
deadlocks. An error path was missed though, that still takes
discipline_mutex and thus has the original deadlock potential.

Intermittent deadlocks were seen when a qeth channel path is configured
offline, causing a race between qeth_do_reset and ccwgroup_remove.
Call qeth_set_offline() directly in the qeth_do_reset() error case and
then a new variant of ccwgroup_set_offline(), without taking
discipline_mutex.

Fixes: b41b554c ("s390/qeth: fix locking for discipline setup / removal")
Signed-off-by: default avatarAlexandra Winter <wintera@linux.ibm.com>
Reviewed-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>

Conflicts:
        arch/s390/include/asm/ccwgroup.h
[Fix context]
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parent 12511146

arch/s390/include/asm/ccwgroup.h

+1 −1
Original line number Diff line number Diff line
@@ -58,7 +58,7 @@ struct ccwgroup_device *get_ccwgroupdev_by_busid(struct ccwgroup_driver *gdrv, 
						 char *bus_id);



extern int ccwgroup_set_online(struct ccwgroup_device *gdev);

extern int ccwgroup_set_offline(struct ccwgroup_device *gdev);

int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv);



extern int ccwgroup_probe_ccwdev(struct ccw_device *cdev);

extern void ccwgroup_remove_ccwdev(struct ccw_device *cdev);

drivers/s390/cio/ccwgroup.c

+8 −2
Original line number Diff line number Diff line
@@ -98,12 +98,13 @@ EXPORT_SYMBOL(ccwgroup_set_online); 
/**

 * ccwgroup_set_offline() - disable a ccwgroup device

 * @gdev: target ccwgroup device

 * @call_gdrv: Call the registered gdrv set_offline function

 *

 * This function attempts to put the ccwgroup device into the offline state.

 * Returns:

 *  %0 on success and a negative error value on failure.

 */

int ccwgroup_set_offline(struct ccwgroup_device *gdev)

int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv)

{

	struct ccwgroup_driver *gdrv = to_ccwgroupdrv(gdev->dev.driver);

	int ret = -EINVAL;
@@ -112,11 +113,16 @@ int ccwgroup_set_offline(struct ccwgroup_device *gdev) 
		return -EAGAIN;

	if (gdev->state == CCWGROUP_OFFLINE)

		goto out;

	if (!call_gdrv) {

		ret = 0;

		goto offline;

	}

	if (gdrv->set_offline)

		ret = gdrv->set_offline(gdev);

	if (ret)

		goto out;



offline:

	gdev->state = CCWGROUP_OFFLINE;

out:

	atomic_set(&gdev->onoff, 0);
@@ -145,7 +151,7 @@ static ssize_t ccwgroup_online_store(struct device *dev, 
	if (value == 1)

		ret = ccwgroup_set_online(gdev);

	else if (value == 0)

		ret = ccwgroup_set_offline(gdev);

		ret = ccwgroup_set_offline(gdev, true);

	else

		ret = -EINVAL;

out:

drivers/s390/net/qeth_core_main.c

+2 −1
Original line number Diff line number Diff line
@@ -5396,7 +5396,8 @@ static int qeth_do_reset(void *data) 
		dev_info(&card->gdev->dev,

			 "Device successfully recovered!\n");

	} else {

		ccwgroup_set_offline(card->gdev);

		qeth_set_offline(card, disc, true);

		ccwgroup_set_offline(card->gdev, false);

		dev_warn(&card->gdev->dev,

			 "The qeth device driver failed to recover an error on the device\n");

	}