From a9e5a410ca9a5001419f606ed8897c69f4a7aa32 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 13 Nov 2012 19:34:52 -0800 Subject: [PATCH] 3.0-stable patches added patches: intel-iommu-fix-ab-ba-lockdep-report.patch --- ...intel-iommu-fix-ab-ba-lockdep-report.patch | 157 ++++++++++++++++++ queue-3.0/series | 1 + 2 files changed, 158 insertions(+) create mode 100644 queue-3.0/intel-iommu-fix-ab-ba-lockdep-report.patch diff --git a/queue-3.0/intel-iommu-fix-ab-ba-lockdep-report.patch b/queue-3.0/intel-iommu-fix-ab-ba-lockdep-report.patch new file mode 100644 index 00000000000..e2251c00d94 --- /dev/null +++ b/queue-3.0/intel-iommu-fix-ab-ba-lockdep-report.patch @@ -0,0 +1,157 @@ +From 3e7abe2556b583e87dabda3e0e6178a67b20d06f Mon Sep 17 00:00:00 2001 +From: Roland Dreier +Date: Wed, 20 Jul 2011 06:22:21 -0700 +Subject: intel-iommu: Fix AB-BA lockdep report + +From: Roland Dreier + +commit 3e7abe2556b583e87dabda3e0e6178a67b20d06f upstream. + +When unbinding a device so that I could pass it through to a KVM VM, I +got the lockdep report below. It looks like a legitimate lock +ordering problem: + + - domain_context_mapping_one() takes iommu->lock and calls + iommu_support_dev_iotlb(), which takes device_domain_lock (inside + iommu->lock). + + - domain_remove_one_dev_info() starts by taking device_domain_lock + then takes iommu->lock inside it (near the end of the function). + +So this is the classic AB-BA deadlock. It looks like a safe fix is to +simply release device_domain_lock a bit earlier, since as far as I can +tell, it doesn't protect any of the stuff accessed at the end of +domain_remove_one_dev_info() anyway. + +BTW, the use of device_domain_lock looks a bit unsafe to me... it's +at least not obvious to me why we aren't vulnerable to the race below: + + iommu_support_dev_iotlb() + domain_remove_dev_info() + + lock device_domain_lock + find info + unlock device_domain_lock + + lock device_domain_lock + find same info + unlock device_domain_lock + + free_devinfo_mem(info) + + do stuff with info after it's free + +However I don't understand the locking here well enough to know if +this is a real problem, let alone what the best fix is. + +Anyway here's the full lockdep output that prompted all of this: + + ======================================================= + [ INFO: possible circular locking dependency detected ] + 2.6.39.1+ #1 + ------------------------------------------------------- + bash/13954 is trying to acquire lock: + (&(&iommu->lock)->rlock){......}, at: [] domain_remove_one_dev_info+0x121/0x230 + + but task is already holding lock: + (device_domain_lock){-.-...}, at: [] domain_remove_one_dev_info+0x208/0x230 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #1 (device_domain_lock){-.-...}: + [] lock_acquire+0x9d/0x130 + [] _raw_spin_lock_irqsave+0x55/0xa0 + [] domain_context_mapping_one+0x600/0x750 + [] domain_context_mapping+0x3f/0x120 + [] iommu_prepare_identity_map+0x1c5/0x1e0 + [] intel_iommu_init+0x88e/0xb5e + [] pci_iommu_init+0x16/0x41 + [] do_one_initcall+0x45/0x190 + [] kernel_init+0xe3/0x168 + [] kernel_thread_helper+0x4/0x10 + + -> #0 (&(&iommu->lock)->rlock){......}: + [] __lock_acquire+0x195e/0x1e10 + [] lock_acquire+0x9d/0x130 + [] _raw_spin_lock_irqsave+0x55/0xa0 + [] domain_remove_one_dev_info+0x121/0x230 + [] device_notifier+0x72/0x90 + [] notifier_call_chain+0x8c/0xc0 + [] __blocking_notifier_call_chain+0x78/0xb0 + [] blocking_notifier_call_chain+0x16/0x20 + [] __device_release_driver+0xbc/0xe0 + [] device_release_driver+0x2f/0x50 + [] driver_unbind+0xa3/0xc0 + [] drv_attr_store+0x2c/0x30 + [] sysfs_write_file+0xe6/0x170 + [] vfs_write+0xce/0x190 + [] sys_write+0x54/0xa0 + [] system_call_fastpath+0x16/0x1b + + other info that might help us debug this: + + 6 locks held by bash/13954: + #0: (&buffer->mutex){+.+.+.}, at: [] sysfs_write_file+0x44/0x170 + #1: (s_active#3){++++.+}, at: [] sysfs_write_file+0xcd/0x170 + #2: (&__lockdep_no_validate__){+.+.+.}, at: [] driver_unbind+0x9b/0xc0 + #3: (&__lockdep_no_validate__){+.+.+.}, at: [] device_release_driver+0x27/0x50 + #4: (&(&priv->bus_notifier)->rwsem){.+.+.+}, at: [] __blocking_notifier_call_chain+0x5f/0xb0 + #5: (device_domain_lock){-.-...}, at: [] domain_remove_one_dev_info+0x208/0x230 + + stack backtrace: + Pid: 13954, comm: bash Not tainted 2.6.39.1+ #1 + Call Trace: + [] print_circular_bug+0xf7/0x100 + [] __lock_acquire+0x195e/0x1e10 + [] ? trace_hardirqs_off+0xd/0x10 + [] ? trace_hardirqs_on_caller+0x13d/0x180 + [] lock_acquire+0x9d/0x130 + [] ? domain_remove_one_dev_info+0x121/0x230 + [] _raw_spin_lock_irqsave+0x55/0xa0 + [] ? domain_remove_one_dev_info+0x121/0x230 + [] ? trace_hardirqs_off+0xd/0x10 + [] domain_remove_one_dev_info+0x121/0x230 + [] device_notifier+0x72/0x90 + [] notifier_call_chain+0x8c/0xc0 + [] __blocking_notifier_call_chain+0x78/0xb0 + [] blocking_notifier_call_chain+0x16/0x20 + [] __device_release_driver+0xbc/0xe0 + [] device_release_driver+0x2f/0x50 + [] driver_unbind+0xa3/0xc0 + [] drv_attr_store+0x2c/0x30 + [] sysfs_write_file+0xe6/0x170 + [] vfs_write+0xce/0x190 + [] sys_write+0x54/0xa0 + [] system_call_fastpath+0x16/0x1b + +Signed-off-by: Roland Dreier +Signed-off-by: David Woodhouse +Cc: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/intel-iommu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -3573,6 +3573,8 @@ static void domain_remove_one_dev_info(s + found = 1; + } + ++ spin_unlock_irqrestore(&device_domain_lock, flags); ++ + if (found == 0) { + unsigned long tmp_flags; + spin_lock_irqsave(&domain->iommu_lock, tmp_flags); +@@ -3589,8 +3591,6 @@ static void domain_remove_one_dev_info(s + spin_unlock_irqrestore(&iommu->lock, tmp_flags); + } + } +- +- spin_unlock_irqrestore(&device_domain_lock, flags); + } + + static void vm_domain_remove_all_dev_info(struct dmar_domain *domain) diff --git a/queue-3.0/series b/queue-3.0/series index 4df6a7a0a79..3622d22c664 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -36,3 +36,4 @@ drm-i915-fixup-infoframe-support-for-sdvo.patch drm-i915-clear-the-entire-sdvo-infoframe-buffer.patch usb-mos7840-remove-unused-variable.patch xfs-fix-reading-of-wrapped-log-data.patch +intel-iommu-fix-ab-ba-lockdep-report.patch -- 2.47.3