PCI: Add global pci_lock_rescan_remove()

There are multiple PCI device addition and removal code paths that may be
run concurrently with the generic PCI bus rescan and device removal that
can be triggered via sysfs.  If that happens, it may lead to multiple
different, potentially dangerous race conditions.

The most straightforward way to address those problems is to run
the code in question under the same lock that is used by the
generic rescan/remove code in pci-sysfs.c.  To prepare for those
changes, move the definition of the global PCI remove/rescan lock
to probe.c and provide global wrappers, pci_lock_rescan_remove()
and pci_unlock_rescan_remove(), allowing drivers to manipulate
that lock.  Also provide pci_stop_and_remove_bus_device_locked()
for the callers of pci_stop_and_remove_bus_device() who only need
to hold the rescan/remove lock around it.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>

diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index c91e6c18debcdd14c5151d74c1c66ccb9b049a41..276ef9c18802c07cb8371b1147acf12529ef3e0e 100644 (file)
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -297,7 +297,6 @@ msi_bus_store(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RW(msi_bus);
 
-static DEFINE_MUTEX(pci_remove_rescan_mutex);
 static ssize_t bus_rescan_store(struct bus_type *bus, const char *buf,
                                size_t count)
 {
@@ -308,10 +307,10 @@ static ssize_t bus_rescan_store(struct bus_type *bus, const char *buf,
                return -EINVAL;
 
        if (val) {
-               mutex_lock(&pci_remove_rescan_mutex);
+               pci_lock_rescan_remove();
                while ((b = pci_find_next_bus(b)) != NULL)
                        pci_rescan_bus(b);
-               mutex_unlock(&pci_remove_rescan_mutex);
+               pci_unlock_rescan_remove();
        }
        return count;
 }
@@ -342,9 +341,9 @@ dev_rescan_store(struct device *dev, struct device_attribute *attr,
                return -EINVAL;
 
        if (val) {
-               mutex_lock(&pci_remove_rescan_mutex);
+               pci_lock_rescan_remove();
                pci_rescan_bus(pdev->bus);
-               mutex_unlock(&pci_remove_rescan_mutex);
+               pci_unlock_rescan_remove();
        }
        return count;
 }
@@ -354,11 +353,7 @@ static struct device_attribute dev_rescan_attr = __ATTR(rescan,
 
 static void remove_callback(struct device *dev)
 {
-       struct pci_dev *pdev = to_pci_dev(dev);
-
-       mutex_lock(&pci_remove_rescan_mutex);
-       pci_stop_and_remove_bus_device(pdev);
-       mutex_unlock(&pci_remove_rescan_mutex);
+       pci_stop_and_remove_bus_device_locked(to_pci_dev(dev));
 }
 
 static ssize_t
@@ -395,12 +390,12 @@ dev_bus_rescan_store(struct device *dev, struct device_attribute *attr,
                return -EINVAL;
 
        if (val) {
-               mutex_lock(&pci_remove_rescan_mutex);
+               pci_lock_rescan_remove();
                if (!pci_is_root_bus(bus) && list_empty(&bus->devices))
                        pci_rescan_bus_bridge_resize(bus->self);
                else
                        pci_rescan_bus(bus);
-               mutex_unlock(&pci_remove_rescan_mutex);
+               pci_unlock_rescan_remove();
        }
        return count;
 }

diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index c86c8638d3c46b9656fb8d0206a90bb1fd35d74e..04796c056d1201d3334a0609b133fda1e15018c3 100644 (file)
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -2024,6 +2024,24 @@ EXPORT_SYMBOL(pci_scan_slot);
 EXPORT_SYMBOL(pci_scan_bridge);
 EXPORT_SYMBOL_GPL(pci_scan_child_bus);
 
+/*
+ * pci_rescan_bus(), pci_rescan_bus_bridge_resize() and PCI device removal
+ * routines should always be executed under this mutex.
+ */
+static DEFINE_MUTEX(pci_rescan_remove_lock);
+
+void pci_lock_rescan_remove(void)
+{
+       mutex_lock(&pci_rescan_remove_lock);
+}
+EXPORT_SYMBOL_GPL(pci_lock_rescan_remove);
+
+void pci_unlock_rescan_remove(void)
+{
+       mutex_unlock(&pci_rescan_remove_lock);
+}
+EXPORT_SYMBOL_GPL(pci_unlock_rescan_remove);
+
 static int __init pci_sort_bf_cmp(const struct device *d_a, const struct device *d_b)
 {
        const struct pci_dev *a = to_pci_dev(d_a);

diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index f452148e6d55ac3fef4c634e1255572c952d7886..10fa13f9e309e211520b89b63ed3c57be104285f 100644 (file)
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -95,6 +95,14 @@ void pci_stop_and_remove_bus_device(struct pci_dev *dev)
 }
 EXPORT_SYMBOL(pci_stop_and_remove_bus_device);
 
+void pci_stop_and_remove_bus_device_locked(struct pci_dev *dev)
+{
+       pci_lock_rescan_remove();
+       pci_stop_and_remove_bus_device(dev);
+       pci_unlock_rescan_remove();
+}
+EXPORT_SYMBOL_GPL(pci_stop_and_remove_bus_device_locked);
+
 void pci_stop_root_bus(struct pci_bus *bus)
 {
        struct pci_dev *child, *tmp;

diff --git a/include/linux/pci.h b/include/linux/pci.h
index 9e3ec8b951b77a828bd72df20200ae25b26dc4ed..2087e6b35545e407626ed84698ff929b7c75209b 100644 (file)
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -775,6 +775,7 @@ struct pci_dev *pci_dev_get(struct pci_dev *dev);
 void pci_dev_put(struct pci_dev *dev);
 void pci_remove_bus(struct pci_bus *b);
 void pci_stop_and_remove_bus_device(struct pci_dev *dev);
+void pci_stop_and_remove_bus_device_locked(struct pci_dev *dev);
 void pci_stop_root_bus(struct pci_bus *bus);
 void pci_remove_root_bus(struct pci_bus *bus);
 void pci_setup_cardbus(struct pci_bus *bus);
@@ -1011,6 +1012,8 @@ void set_pcie_hotplug_bridge(struct pci_dev *pdev);
 int pci_bus_find_capability(struct pci_bus *bus, unsigned int devfn, int cap);
 unsigned int pci_rescan_bus_bridge_resize(struct pci_dev *bridge);
 unsigned int pci_rescan_bus(struct pci_bus *bus);
+void pci_lock_rescan_remove(void);
+void pci_unlock_rescan_remove(void);
 
 /* Vital product data routines */
 ssize_t pci_read_vpd(struct pci_dev *dev, loff_t pos, size_t count, void *buf);