179723fc78
commit c7acef99642b763ba585f4a43af999fcdbcc3dc4 upstream. Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver. The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router's Root Port and thus causes hot removal of the dock. The crash occurs when pciehp is unbound from one of the dock's Downstream Ports: pciehp creates a pci_slot on bind and destroys it on unbind. The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired. The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot->bus. In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device(). However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device(). To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy: It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device(). There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device(). In Dennis' case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices(). pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device(). Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free. One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run. However it seems risky that pci_slot points to pci_bus without holding a reference. Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming. If pci_slot has a need to access data in pci_bus, it ought to acquire a reference. Amend pci_create_slot() accordingly. Dennis reports that the crash is not reproducible with this change. Abridged stacktrace: pcieport 0000:00:07.0: PME: Signaling with IRQ 156 pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, created physical slot 12 pcieport 0000:00:07.0: pciehp: Slot(12): Card not present ... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0 Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 pci_destroy_slot pciehp_remove pcie_port_remove_service device_release_driver_internal bus_remove_device device_del device_unregister remove_iter device_for_each_child pcie_portdrv_remove pci_device_remove device_release_driver_internal bus_remove_device device_del pci_remove_bus_device (recursive invocation) pci_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Link: https://lore.kernel.org/r/4bfd4c0e976c1776cd08e76603903b338cf25729.1728579288.git.lukas@wunner.de Reported-by: Dennis Wassenberg <Dennis.Wassenberg@secunet.com> Closes: https://lore.kernel.org/r/6de4b45ff2b32dd91a805ec02ec8ec73ef411bf6.camel@secunet.com/ Tested-by: Dennis Wassenberg <Dennis.Wassenberg@secunet.com> Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com> Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
381 lines
9.7 KiB
C
Executable file
381 lines
9.7 KiB
C
Executable file
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (C) 2006 Matthew Wilcox <matthew@wil.cx>
|
|
* Copyright (C) 2006-2009 Hewlett-Packard Development Company, L.P.
|
|
* Alex Chiang <achiang@hp.com>
|
|
*/
|
|
|
|
#include <linux/kobject.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/module.h>
|
|
#include <linux/pci.h>
|
|
#include <linux/err.h>
|
|
#include "pci.h"
|
|
|
|
struct kset *pci_slots_kset;
|
|
EXPORT_SYMBOL_GPL(pci_slots_kset);
|
|
|
|
static ssize_t pci_slot_attr_show(struct kobject *kobj,
|
|
struct attribute *attr, char *buf)
|
|
{
|
|
struct pci_slot *slot = to_pci_slot(kobj);
|
|
struct pci_slot_attribute *attribute = to_pci_slot_attr(attr);
|
|
return attribute->show ? attribute->show(slot, buf) : -EIO;
|
|
}
|
|
|
|
static ssize_t pci_slot_attr_store(struct kobject *kobj,
|
|
struct attribute *attr, const char *buf, size_t len)
|
|
{
|
|
struct pci_slot *slot = to_pci_slot(kobj);
|
|
struct pci_slot_attribute *attribute = to_pci_slot_attr(attr);
|
|
return attribute->store ? attribute->store(slot, buf, len) : -EIO;
|
|
}
|
|
|
|
static const struct sysfs_ops pci_slot_sysfs_ops = {
|
|
.show = pci_slot_attr_show,
|
|
.store = pci_slot_attr_store,
|
|
};
|
|
|
|
static ssize_t address_read_file(struct pci_slot *slot, char *buf)
|
|
{
|
|
if (slot->number == 0xff)
|
|
return sprintf(buf, "%04x:%02x\n",
|
|
pci_domain_nr(slot->bus),
|
|
slot->bus->number);
|
|
else
|
|
return sprintf(buf, "%04x:%02x:%02x\n",
|
|
pci_domain_nr(slot->bus),
|
|
slot->bus->number,
|
|
slot->number);
|
|
}
|
|
|
|
static ssize_t bus_speed_read(enum pci_bus_speed speed, char *buf)
|
|
{
|
|
return sprintf(buf, "%s\n", pci_speed_string(speed));
|
|
}
|
|
|
|
static ssize_t max_speed_read_file(struct pci_slot *slot, char *buf)
|
|
{
|
|
return bus_speed_read(slot->bus->max_bus_speed, buf);
|
|
}
|
|
|
|
static ssize_t cur_speed_read_file(struct pci_slot *slot, char *buf)
|
|
{
|
|
return bus_speed_read(slot->bus->cur_bus_speed, buf);
|
|
}
|
|
|
|
static void pci_slot_release(struct kobject *kobj)
|
|
{
|
|
struct pci_dev *dev;
|
|
struct pci_slot *slot = to_pci_slot(kobj);
|
|
|
|
dev_dbg(&slot->bus->dev, "dev %02x, released physical slot %s\n",
|
|
slot->number, pci_slot_name(slot));
|
|
|
|
down_read(&pci_bus_sem);
|
|
list_for_each_entry(dev, &slot->bus->devices, bus_list)
|
|
if (PCI_SLOT(dev->devfn) == slot->number)
|
|
dev->slot = NULL;
|
|
up_read(&pci_bus_sem);
|
|
|
|
list_del(&slot->list);
|
|
pci_bus_put(slot->bus);
|
|
|
|
kfree(slot);
|
|
}
|
|
|
|
static struct pci_slot_attribute pci_slot_attr_address =
|
|
__ATTR(address, S_IRUGO, address_read_file, NULL);
|
|
static struct pci_slot_attribute pci_slot_attr_max_speed =
|
|
__ATTR(max_bus_speed, S_IRUGO, max_speed_read_file, NULL);
|
|
static struct pci_slot_attribute pci_slot_attr_cur_speed =
|
|
__ATTR(cur_bus_speed, S_IRUGO, cur_speed_read_file, NULL);
|
|
|
|
static struct attribute *pci_slot_default_attrs[] = {
|
|
&pci_slot_attr_address.attr,
|
|
&pci_slot_attr_max_speed.attr,
|
|
&pci_slot_attr_cur_speed.attr,
|
|
NULL,
|
|
};
|
|
|
|
static struct kobj_type pci_slot_ktype = {
|
|
.sysfs_ops = &pci_slot_sysfs_ops,
|
|
.release = &pci_slot_release,
|
|
.default_attrs = pci_slot_default_attrs,
|
|
};
|
|
|
|
static char *make_slot_name(const char *name)
|
|
{
|
|
char *new_name;
|
|
int len, max, dup;
|
|
|
|
new_name = kstrdup(name, GFP_KERNEL);
|
|
if (!new_name)
|
|
return NULL;
|
|
|
|
/*
|
|
* Make sure we hit the realloc case the first time through the
|
|
* loop. 'len' will be strlen(name) + 3 at that point which is
|
|
* enough space for "name-X" and the trailing NUL.
|
|
*/
|
|
len = strlen(name) + 2;
|
|
max = 1;
|
|
dup = 1;
|
|
|
|
for (;;) {
|
|
struct kobject *dup_slot;
|
|
dup_slot = kset_find_obj(pci_slots_kset, new_name);
|
|
if (!dup_slot)
|
|
break;
|
|
kobject_put(dup_slot);
|
|
if (dup == max) {
|
|
len++;
|
|
max *= 10;
|
|
kfree(new_name);
|
|
new_name = kmalloc(len, GFP_KERNEL);
|
|
if (!new_name)
|
|
break;
|
|
}
|
|
sprintf(new_name, "%s-%d", name, dup++);
|
|
}
|
|
|
|
return new_name;
|
|
}
|
|
|
|
static int rename_slot(struct pci_slot *slot, const char *name)
|
|
{
|
|
int result = 0;
|
|
char *slot_name;
|
|
|
|
if (strcmp(pci_slot_name(slot), name) == 0)
|
|
return result;
|
|
|
|
slot_name = make_slot_name(name);
|
|
if (!slot_name)
|
|
return -ENOMEM;
|
|
|
|
result = kobject_rename(&slot->kobj, slot_name);
|
|
kfree(slot_name);
|
|
|
|
return result;
|
|
}
|
|
|
|
void pci_dev_assign_slot(struct pci_dev *dev)
|
|
{
|
|
struct pci_slot *slot;
|
|
|
|
mutex_lock(&pci_slot_mutex);
|
|
list_for_each_entry(slot, &dev->bus->slots, list)
|
|
if (PCI_SLOT(dev->devfn) == slot->number)
|
|
dev->slot = slot;
|
|
mutex_unlock(&pci_slot_mutex);
|
|
}
|
|
|
|
static struct pci_slot *get_slot(struct pci_bus *parent, int slot_nr)
|
|
{
|
|
struct pci_slot *slot;
|
|
|
|
/* We already hold pci_slot_mutex */
|
|
list_for_each_entry(slot, &parent->slots, list)
|
|
if (slot->number == slot_nr) {
|
|
kobject_get(&slot->kobj);
|
|
return slot;
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* pci_create_slot - create or increment refcount for physical PCI slot
|
|
* @parent: struct pci_bus of parent bridge
|
|
* @slot_nr: PCI_SLOT(pci_dev->devfn) or -1 for placeholder
|
|
* @name: user visible string presented in /sys/bus/pci/slots/<name>
|
|
* @hotplug: set if caller is hotplug driver, NULL otherwise
|
|
*
|
|
* PCI slots have first class attributes such as address, speed, width,
|
|
* and a &struct pci_slot is used to manage them. This interface will
|
|
* either return a new &struct pci_slot to the caller, or if the pci_slot
|
|
* already exists, its refcount will be incremented.
|
|
*
|
|
* Slots are uniquely identified by a @pci_bus, @slot_nr tuple.
|
|
*
|
|
* There are known platforms with broken firmware that assign the same
|
|
* name to multiple slots. Workaround these broken platforms by renaming
|
|
* the slots on behalf of the caller. If firmware assigns name N to
|
|
* multiple slots:
|
|
*
|
|
* The first slot is assigned N
|
|
* The second slot is assigned N-1
|
|
* The third slot is assigned N-2
|
|
* etc.
|
|
*
|
|
* Placeholder slots:
|
|
* In most cases, @pci_bus, @slot_nr will be sufficient to uniquely identify
|
|
* a slot. There is one notable exception - pSeries (rpaphp), where the
|
|
* @slot_nr cannot be determined until a device is actually inserted into
|
|
* the slot. In this scenario, the caller may pass -1 for @slot_nr.
|
|
*
|
|
* The following semantics are imposed when the caller passes @slot_nr ==
|
|
* -1. First, we no longer check for an existing %struct pci_slot, as there
|
|
* may be many slots with @slot_nr of -1. The other change in semantics is
|
|
* user-visible, which is the 'address' parameter presented in sysfs will
|
|
* consist solely of a dddd:bb tuple, where dddd is the PCI domain of the
|
|
* %struct pci_bus and bb is the bus number. In other words, the devfn of
|
|
* the 'placeholder' slot will not be displayed.
|
|
*/
|
|
struct pci_slot *pci_create_slot(struct pci_bus *parent, int slot_nr,
|
|
const char *name,
|
|
struct hotplug_slot *hotplug)
|
|
{
|
|
struct pci_dev *dev;
|
|
struct pci_slot *slot;
|
|
int err = 0;
|
|
char *slot_name = NULL;
|
|
|
|
mutex_lock(&pci_slot_mutex);
|
|
|
|
if (slot_nr == -1)
|
|
goto placeholder;
|
|
|
|
/*
|
|
* Hotplug drivers are allowed to rename an existing slot,
|
|
* but only if not already claimed.
|
|
*/
|
|
slot = get_slot(parent, slot_nr);
|
|
if (slot) {
|
|
if (hotplug) {
|
|
if ((err = slot->hotplug ? -EBUSY : 0)
|
|
|| (err = rename_slot(slot, name))) {
|
|
kobject_put(&slot->kobj);
|
|
slot = NULL;
|
|
goto err;
|
|
}
|
|
}
|
|
goto out;
|
|
}
|
|
|
|
placeholder:
|
|
slot = kzalloc(sizeof(*slot), GFP_KERNEL);
|
|
if (!slot) {
|
|
err = -ENOMEM;
|
|
goto err;
|
|
}
|
|
|
|
slot->bus = pci_bus_get(parent);
|
|
slot->number = slot_nr;
|
|
|
|
slot->kobj.kset = pci_slots_kset;
|
|
|
|
slot_name = make_slot_name(name);
|
|
if (!slot_name) {
|
|
err = -ENOMEM;
|
|
pci_bus_put(slot->bus);
|
|
kfree(slot);
|
|
goto err;
|
|
}
|
|
|
|
INIT_LIST_HEAD(&slot->list);
|
|
list_add(&slot->list, &parent->slots);
|
|
|
|
err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
|
|
"%s", slot_name);
|
|
if (err) {
|
|
kobject_put(&slot->kobj);
|
|
goto err;
|
|
}
|
|
|
|
down_read(&pci_bus_sem);
|
|
list_for_each_entry(dev, &parent->devices, bus_list)
|
|
if (PCI_SLOT(dev->devfn) == slot_nr)
|
|
dev->slot = slot;
|
|
up_read(&pci_bus_sem);
|
|
|
|
dev_dbg(&parent->dev, "dev %02x, created physical slot %s\n",
|
|
slot_nr, pci_slot_name(slot));
|
|
|
|
out:
|
|
kfree(slot_name);
|
|
mutex_unlock(&pci_slot_mutex);
|
|
return slot;
|
|
err:
|
|
slot = ERR_PTR(err);
|
|
goto out;
|
|
}
|
|
EXPORT_SYMBOL_GPL(pci_create_slot);
|
|
|
|
/**
|
|
* pci_destroy_slot - decrement refcount for physical PCI slot
|
|
* @slot: struct pci_slot to decrement
|
|
*
|
|
* %struct pci_slot is refcounted, so destroying them is really easy; we
|
|
* just call kobject_put on its kobj and let our release methods do the
|
|
* rest.
|
|
*/
|
|
void pci_destroy_slot(struct pci_slot *slot)
|
|
{
|
|
dev_dbg(&slot->bus->dev, "dev %02x, dec refcount to %d\n",
|
|
slot->number, kref_read(&slot->kobj.kref) - 1);
|
|
|
|
mutex_lock(&pci_slot_mutex);
|
|
kobject_put(&slot->kobj);
|
|
mutex_unlock(&pci_slot_mutex);
|
|
}
|
|
EXPORT_SYMBOL_GPL(pci_destroy_slot);
|
|
|
|
#if defined(CONFIG_HOTPLUG_PCI) || defined(CONFIG_HOTPLUG_PCI_MODULE)
|
|
#include <linux/pci_hotplug.h>
|
|
/**
|
|
* pci_hp_create_link - create symbolic link to the hotplug driver module.
|
|
* @pci_slot: struct pci_slot
|
|
*
|
|
* Helper function for pci_hotplug_core.c to create symbolic link to
|
|
* the hotplug driver module.
|
|
*/
|
|
void pci_hp_create_module_link(struct pci_slot *pci_slot)
|
|
{
|
|
struct hotplug_slot *slot = pci_slot->hotplug;
|
|
struct kobject *kobj = NULL;
|
|
int ret;
|
|
|
|
if (!slot || !slot->ops)
|
|
return;
|
|
kobj = kset_find_obj(module_kset, slot->mod_name);
|
|
if (!kobj)
|
|
return;
|
|
ret = sysfs_create_link(&pci_slot->kobj, kobj, "module");
|
|
if (ret)
|
|
dev_err(&pci_slot->bus->dev, "Error creating sysfs link (%d)\n",
|
|
ret);
|
|
kobject_put(kobj);
|
|
}
|
|
EXPORT_SYMBOL_GPL(pci_hp_create_module_link);
|
|
|
|
/**
|
|
* pci_hp_remove_link - remove symbolic link to the hotplug driver module.
|
|
* @pci_slot: struct pci_slot
|
|
*
|
|
* Helper function for pci_hotplug_core.c to remove symbolic link to
|
|
* the hotplug driver module.
|
|
*/
|
|
void pci_hp_remove_module_link(struct pci_slot *pci_slot)
|
|
{
|
|
sysfs_remove_link(&pci_slot->kobj, "module");
|
|
}
|
|
EXPORT_SYMBOL_GPL(pci_hp_remove_module_link);
|
|
#endif
|
|
|
|
static int pci_slot_init(void)
|
|
{
|
|
struct kset *pci_bus_kset;
|
|
|
|
pci_bus_kset = bus_get_kset(&pci_bus_type);
|
|
pci_slots_kset = kset_create_and_add("slots", NULL,
|
|
&pci_bus_kset->kobj);
|
|
if (!pci_slots_kset) {
|
|
pr_err("PCI: Slot initialization failure\n");
|
|
return -ENOMEM;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
subsys_initcall(pci_slot_init);
|