genirq: Prevent nested thread vs synchronize_hardirq() deadlock

There is a possibility of deadlock if synchronize_hardirq() is called
when the nested threaded interrupt is active.  The following scenario
was observed on a uniprocessor PREEMPT_NONE system:

 Thread 1                      Thread 2

 handle_nested_thread()
  Set INPROGRESS
  Call ->thread_fn()
   thread_fn goes to sleep

                              free_irq()
                               __synchronize_hardirq()
                                Busy-loop forever waiting for INPROGRESS
                                to be cleared

The INPROGRESS flag is only supposed to be used for hard interrupt
handlers.  Remove the incorrect usage in the nested threaded interrupt
case and instead re-use the threads_active / wait_for_threads mechanism
to wait for nested threaded interrupts to complete.

Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20230613-genirq-nested-v3-1-ae58221143eb@axis.com

diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index ee8c0acf39df196d6d4944ae5813a98e44e807d4..dc94e0bf2c9408e2aefc2094528b47f8f8372ad7 100644 (file)
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -473,11 +473,12 @@ void handle_nested_irq(unsigned int irq)
        action = desc->action;
        if (unlikely(!action || irqd_irq_disabled(&desc->irq_data))) {
                desc->istate |= IRQS_PENDING;
-               goto out_unlock;
+               raw_spin_unlock_irq(&desc->lock);
+               return;
        }
 
        kstat_incr_irqs_this_cpu(desc);
-       irqd_set(&desc->irq_data, IRQD_IRQ_INPROGRESS);
+       atomic_inc(&desc->threads_active);
        raw_spin_unlock_irq(&desc->lock);
 
        action_ret = IRQ_NONE;
@@ -487,11 +488,7 @@ void handle_nested_irq(unsigned int irq)
        if (!irq_settings_no_debug(desc))
                note_interrupt(desc, action_ret);
 
-       raw_spin_lock_irq(&desc->lock);
-       irqd_clear(&desc->irq_data, IRQD_IRQ_INPROGRESS);
-
-out_unlock:
-       raw_spin_unlock_irq(&desc->lock);
+       wake_threads_waitq(desc);
 }
 EXPORT_SYMBOL_GPL(handle_nested_irq);
 

diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index bdd35bb9c7357c1aaa7fd4faa39d1a0570d6b539..831f383084663b9a657714074ecab534563ddcd2 100644 (file)
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -121,6 +121,8 @@ void irq_resend_init(struct irq_desc *desc);
 bool irq_wait_for_poll(struct irq_desc *desc);
 void __irq_wake_thread(struct irq_desc *desc, struct irqaction *action);
 
+void wake_threads_waitq(struct irq_desc *desc);
+
 #ifdef CONFIG_PROC_FS
 extern void register_irq_proc(unsigned int irq, struct irq_desc *desc);
 extern void unregister_irq_proc(unsigned int irq, struct irq_desc *desc);

diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index d2742af0f0fd870124c8fa189c102e8f330ff4d9..d309ba84e08a9d9b0137e82ea2f0209d7afc000e 100644 (file)
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -108,6 +108,16 @@ bool synchronize_hardirq(unsigned int irq)
 }
 EXPORT_SYMBOL(synchronize_hardirq);
 
+static void __synchronize_irq(struct irq_desc *desc)
+{
+       __synchronize_hardirq(desc, true);
+       /*
+        * We made sure that no hardirq handler is running. Now verify that no
+        * threaded handlers are active.
+        */
+       wait_event(desc->wait_for_threads, !atomic_read(&desc->threads_active));
+}
+
 /**
  *     synchronize_irq - wait for pending IRQ handlers (on other CPUs)
  *     @irq: interrupt number to wait for
@@ -127,16 +137,8 @@ void synchronize_irq(unsigned int irq)
 {
        struct irq_desc *desc = irq_to_desc(irq);
 
-       if (desc) {
-               __synchronize_hardirq(desc, true);
-               /*
-                * We made sure that no hardirq handler is
-                * running. Now verify that no threaded handlers are
-                * active.
-                */
-               wait_event(desc->wait_for_threads,
-                          !atomic_read(&desc->threads_active));
-       }
+       if (desc)
+               __synchronize_irq(desc);
 }
 EXPORT_SYMBOL(synchronize_irq);
 
@@ -1216,7 +1218,7 @@ static irqreturn_t irq_thread_fn(struct irq_desc *desc,
        return ret;
 }
 
-static void wake_threads_waitq(struct irq_desc *desc)
+void wake_threads_waitq(struct irq_desc *desc)
 {
        if (atomic_dec_and_test(&desc->threads_active))
                wake_up(&desc->wait_for_threads);
@@ -1944,7 +1946,7 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
         * supports it also make sure that there is no (not yet serviced)
         * interrupt in flight at the hardware level.
         */
-       __synchronize_hardirq(desc, true);
+       __synchronize_irq(desc);
 
 #ifdef CONFIG_DEBUG_SHIRQ
        /*