From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Oleksij Rempel <o.rempel@pengutronix.de>,
Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>,
andrew@lunn.ch, vivien.didelot@gmail.com, f.fainelli@gmail.com,
olteanv@gmail.com, davem@davemloft.net, edumazet@google.com,
pabeni@redhat.com, linux@rempel-privat.de,
rmk+kernel@armlinux.org.uk, sean.anderson@seco.com,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 16/46] net: dsa: ar9331: fix potential dead lock on mdio access
Date: Thu, 11 Aug 2022 12:03:40 -0400 [thread overview]
Message-ID: <20220811160421.1539956-16-sashal@kernel.org> (raw)
In-Reply-To: <20220811160421.1539956-1-sashal@kernel.org>
From: Oleksij Rempel <o.rempel@pengutronix.de>
[ Upstream commit 7a49f2193063b7db60a964fc26774275a4c964cd ]
Rework MDIO locking to avoid potential circular locking:
WARNING: possible circular locking dependency detected
5.19.0-rc1-ar9331-00017-g3ab364c7c48c #5 Not tainted
------------------------------------------------------
kworker/u2:4/68 is trying to acquire lock:
81f3c83c (ar9331:1005:(&ar9331_mdio_regmap_config)->lock){+.+.}-{4:4}, at: regmap_write+0x50/0x8c
but task is already holding lock:
81f60494 (&bus->mdio_lock){+.+.}-{4:4}, at: mdiobus_read+0x40/0x78
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&bus->mdio_lock){+.+.}-{4:4}:
lock_acquire+0x2d4/0x360
__mutex_lock+0xf8/0x384
mutex_lock_nested+0x2c/0x38
mdiobus_write+0x44/0x80
ar9331_sw_bus_write+0x50/0xe4
_regmap_raw_write_impl+0x604/0x724
_regmap_bus_raw_write+0x9c/0xb4
_regmap_write+0xdc/0x1a0
_regmap_update_bits+0xf4/0x118
_regmap_select_page+0x108/0x138
_regmap_raw_read+0x25c/0x288
_regmap_bus_read+0x60/0x98
_regmap_read+0xd4/0x1b0
_regmap_update_bits+0xc4/0x118
regmap_update_bits_base+0x64/0x8c
ar9331_sw_irq_bus_sync_unlock+0x40/0x6c
__irq_set_handler+0x7c/0xac
ar9331_sw_irq_map+0x48/0x7c
irq_domain_associate+0x174/0x208
irq_create_mapping_affinity+0x1a8/0x230
ar9331_sw_probe+0x22c/0x388
mdio_probe+0x44/0x70
really_probe+0x200/0x424
__driver_probe_device+0x290/0x298
driver_probe_device+0x54/0xe4
__device_attach_driver+0xe4/0x130
bus_for_each_drv+0xb4/0xd8
__device_attach+0x104/0x1a4
bus_probe_device+0x48/0xc4
device_add+0x600/0x800
mdio_device_register+0x68/0xa0
of_mdiobus_register+0x2bc/0x3c4
ag71xx_probe+0x6e4/0x984
platform_probe+0x78/0xd0
really_probe+0x200/0x424
__driver_probe_device+0x290/0x298
driver_probe_device+0x54/0xe4
__driver_attach+0x17c/0x190
bus_for_each_dev+0x8c/0xd0
bus_add_driver+0x110/0x228
driver_register+0xe4/0x12c
do_one_initcall+0x104/0x2a0
kernel_init_freeable+0x250/0x288
kernel_init+0x34/0x130
ret_from_kernel_thread+0x14/0x1c
-> #0 (ar9331:1005:(&ar9331_mdio_regmap_config)->lock){+.+.}-{4:4}:
check_noncircular+0x88/0xc0
__lock_acquire+0x10bc/0x18bc
lock_acquire+0x2d4/0x360
__mutex_lock+0xf8/0x384
mutex_lock_nested+0x2c/0x38
regmap_write+0x50/0x8c
ar9331_sw_mbus_read+0x74/0x1b8
__mdiobus_read+0x90/0xec
mdiobus_read+0x50/0x78
get_phy_device+0xa0/0x18c
fwnode_mdiobus_register_phy+0x120/0x1d4
of_mdiobus_register+0x244/0x3c4
devm_of_mdiobus_register+0xe8/0x100
ar9331_sw_setup+0x16c/0x3a0
dsa_register_switch+0x7dc/0xcc0
ar9331_sw_probe+0x370/0x388
mdio_probe+0x44/0x70
really_probe+0x200/0x424
__driver_probe_device+0x290/0x298
driver_probe_device+0x54/0xe4
__device_attach_driver+0xe4/0x130
bus_for_each_drv+0xb4/0xd8
__device_attach+0x104/0x1a4
bus_probe_device+0x48/0xc4
deferred_probe_work_func+0xf0/0x10c
process_one_work+0x314/0x4d4
worker_thread+0x2a4/0x354
kthread+0x134/0x13c
ret_from_kernel_thread+0x14/0x1c
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&bus->mdio_lock);
lock(ar9331:1005:(&ar9331_mdio_regmap_config)->lock);
lock(&bus->mdio_lock);
lock(ar9331:1005:(&ar9331_mdio_regmap_config)->lock);
*** DEADLOCK ***
5 locks held by kworker/u2:4/68:
#0: 81c04eb4 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1e4/0x4d4
#1: 81f0de78 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work+0x1e4/0x4d4
#2: 81f0a880 (&dev->mutex){....}-{4:4}, at: __device_attach+0x40/0x1a4
#3: 80c8aee0 (dsa2_mutex){+.+.}-{4:4}, at: dsa_register_switch+0x5c/0xcc0
#4: 81f60494 (&bus->mdio_lock){+.+.}-{4:4}, at: mdiobus_read+0x40/0x78
stack backtrace:
CPU: 0 PID: 68 Comm: kworker/u2:4 Not tainted 5.19.0-rc1-ar9331-00017-g3ab364c7c48c #5
Workqueue: events_unbound deferred_probe_work_func
Stack : 00000056 800d4638 81f0d64c 00000004 00000018 00000000 80a20000 80a20000
80937590 81ef3858 81f0d760 3913578a 00000005 8045e824 81f0d600 a8db84cc
00000000 00000000 80937590 00000a44 00000000 00000002 00000001 ffffffff
81f0d6a4 80982d7c 0000000f 20202020 80a20000 00000001 80937590 81ef3858
81f0d760 3913578a 00000005 00000005 00000000 03bd0000 00000000 80e00000
...
Call Trace:
[<80069db0>] show_stack+0x94/0x130
[<8045e824>] dump_stack_lvl+0x54/0x8c
[<800c7fac>] check_noncircular+0x88/0xc0
[<800ca068>] __lock_acquire+0x10bc/0x18bc
[<800cb478>] lock_acquire+0x2d4/0x360
[<807b84c4>] __mutex_lock+0xf8/0x384
[<807b877c>] mutex_lock_nested+0x2c/0x38
[<804ea640>] regmap_write+0x50/0x8c
[<80501e38>] ar9331_sw_mbus_read+0x74/0x1b8
[<804fe9a0>] __mdiobus_read+0x90/0xec
[<804feac4>] mdiobus_read+0x50/0x78
[<804fcf74>] get_phy_device+0xa0/0x18c
[<804ffeb4>] fwnode_mdiobus_register_phy+0x120/0x1d4
[<805004f0>] of_mdiobus_register+0x244/0x3c4
[<804f0c50>] devm_of_mdiobus_register+0xe8/0x100
[<805017a0>] ar9331_sw_setup+0x16c/0x3a0
[<807355c8>] dsa_register_switch+0x7dc/0xcc0
[<80501468>] ar9331_sw_probe+0x370/0x388
[<804ff0c0>] mdio_probe+0x44/0x70
[<804d1848>] really_probe+0x200/0x424
[<804d1cfc>] __driver_probe_device+0x290/0x298
[<804d1d58>] driver_probe_device+0x54/0xe4
[<804d2298>] __device_attach_driver+0xe4/0x130
[<804cf048>] bus_for_each_drv+0xb4/0xd8
[<804d200c>] __device_attach+0x104/0x1a4
[<804d026c>] bus_probe_device+0x48/0xc4
[<804d108c>] deferred_probe_work_func+0xf0/0x10c
[<800a0ffc>] process_one_work+0x314/0x4d4
[<800a17fc>] worker_thread+0x2a4/0x354
[<800a9a54>] kthread+0x134/0x13c
[<8006306c>] ret_from_kernel_thread+0x14/0x1c
[
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20220616112550.877118-1-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/qca/ar9331.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/net/dsa/qca/ar9331.c b/drivers/net/dsa/qca/ar9331.c
index c33bdcf7efc5..59114ecfe555 100644
--- a/drivers/net/dsa/qca/ar9331.c
+++ b/drivers/net/dsa/qca/ar9331.c
@@ -626,7 +626,7 @@ static int __ar9331_mdio_write(struct mii_bus *sbus, u8 mode, u16 reg, u16 val)
FIELD_GET(AR9331_SW_LOW_ADDR_PHY, reg);
r = FIELD_GET(AR9331_SW_LOW_ADDR_REG, reg);
- return mdiobus_write(sbus, p, r, val);
+ return __mdiobus_write(sbus, p, r, val);
}
static int __ar9331_mdio_read(struct mii_bus *sbus, u16 reg)
@@ -637,7 +637,7 @@ static int __ar9331_mdio_read(struct mii_bus *sbus, u16 reg)
FIELD_GET(AR9331_SW_LOW_ADDR_PHY, reg);
r = FIELD_GET(AR9331_SW_LOW_ADDR_REG, reg);
- return mdiobus_read(sbus, p, r);
+ return __mdiobus_read(sbus, p, r);
}
static int ar9331_mdio_read(void *ctx, const void *reg_buf, size_t reg_len,
@@ -657,6 +657,8 @@ static int ar9331_mdio_read(void *ctx, const void *reg_buf, size_t reg_len,
return 0;
}
+ mutex_lock_nested(&sbus->mdio_lock, MDIO_MUTEX_NESTED);
+
ret = __ar9331_mdio_read(sbus, reg);
if (ret < 0)
goto error;
@@ -668,9 +670,13 @@ static int ar9331_mdio_read(void *ctx, const void *reg_buf, size_t reg_len,
*(u32 *)val_buf |= ret << 16;
+ mutex_unlock(&sbus->mdio_lock);
+
return 0;
error:
+ mutex_unlock(&sbus->mdio_lock);
dev_err_ratelimited(&sbus->dev, "Bus error. Failed to read register.\n");
+
return ret;
}
@@ -680,12 +686,15 @@ static int ar9331_mdio_write(void *ctx, u32 reg, u32 val)
struct mii_bus *sbus = priv->sbus;
int ret;
+ mutex_lock_nested(&sbus->mdio_lock, MDIO_MUTEX_NESTED);
if (reg == AR9331_SW_REG_PAGE) {
ret = __ar9331_mdio_write(sbus, AR9331_SW_MDIO_PHY_MODE_PAGE,
0, val);
if (ret < 0)
goto error;
+ mutex_unlock(&sbus->mdio_lock);
+
return 0;
}
@@ -705,10 +714,14 @@ static int ar9331_mdio_write(void *ctx, u32 reg, u32 val)
if (ret < 0)
goto error;
+ mutex_unlock(&sbus->mdio_lock);
+
return 0;
error:
+ mutex_unlock(&sbus->mdio_lock);
dev_err_ratelimited(&sbus->dev, "Bus error. Failed to write register.\n");
+
return ret;
}
--
2.35.1
next prev parent reply other threads:[~2022-08-11 16:25 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-11 16:03 [PATCH AUTOSEL 5.10 01/46] drm/r128: Fix undefined behavior due to shift overflowing the constant Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 02/46] ath10k: htt_tx: do not interpret Eth frames as WiFi Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 03/46] ath10k: fix misreported tx bandwidth for 160Mhz Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 04/46] drm/nouveau: clear output poll workers before nouveau_fbcon_destroy() Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 05/46] drm/panfrost: Handle HW_ISSUE_TTRX_2968_TTRX_3162 Sasha Levin
2022-08-13 13:44 ` Pavel Machek
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 06/46] drm/panfrost: Don't set L2_MMU_CONFIG quirks Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 07/46] ath10k: fix regdomain info of iw reg set/get Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 08/46] drm/amd/display: Detect dpcd_rev when hotplug mst monitor Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 09/46] drm/amd/display: Fix dpp dto for disabled pipes Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 10/46] drm/radeon: integer overflow in radeon_mode_dumb_create() Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 11/46] drm/radeon: Initialize fences array entries in radeon_sa_bo_next_hole Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 12/46] udmabuf: Set the DMA mask for the udmabuf device (v2) Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 13/46] net/mlx5: Add HW definitions of vport debug counters Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 14/46] drm/amd/display: Fix monitor flash issue Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 15/46] selftests: mlxsw: resource_scale: Allow skipping a test Sasha Levin
2022-08-11 16:03 ` Sasha Levin [this message]
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 17/46] media: davinci: vpif: add missing of_node_put() in vpif_probe() Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 18/46] media: mediatek: vcodec: prevent kernel crash when scp ipi timeout Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 19/46] media: airspy: respect the DMA coherency rules Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 20/46] media: pvrusb2: fix memory leak in pvr_probe Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 21/46] rcu: Apply noinstr to rcu_idle_enter() and rcu_idle_exit() Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 22/46] drm/bridge/tc358775: Fix DSI clock division for vsync delay calculation Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 23/46] uprobe: gate bpf call behind BPF_EVENTS Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 24/46] rcuscale: Fix smp_processor_id()-in-preemptible warnings Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 25/46] mlxsw: cmd: Increase 'config_profile.flood_mode' length Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 26/46] media: atmel: atmel-isc-base: allow wb ctrls to be changed when isc is not configured Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 27/46] kselftests: Enable the echo command to print newlines in Makefile Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 28/46] ipv6/addrconf: fix timing bug in tempaddr regen Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 29/46] drm/amdgpu/display/dc: Fix null pointer exception Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 30/46] crypto: vmx - Fix warning on p8_ghash_alg Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 31/46] drm/nouveau/nvkm: use list_add_tail() when building object tree Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 32/46] crypto: ccree - Add missing clk_disable_unprepare() in cc_pm_resume() Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 33/46] bpf: Fix check against plain integer v 'NULL' Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 34/46] media: rkisp1: Disable runtime PM in probe error path Sasha Levin
2022-08-11 16:03 ` [PATCH AUTOSEL 5.10 35/46] bpf: Don't redirect packets with invalid pkt_len Sasha Levin
2022-08-11 16:04 ` [PATCH AUTOSEL 5.10 36/46] can: sja1000: Add Quirk for RZ/N1 SJA1000 CAN controller Sasha Levin
2022-08-11 16:04 ` [PATCH AUTOSEL 5.10 37/46] net/cdc_ncm: Increase NTB max RX/TX values to 64kb Sasha Levin
2022-08-11 16:04 ` [PATCH AUTOSEL 5.10 38/46] Bluetooth: hci_bcm: Add BCM4349B1 variant Sasha Levin
2022-08-11 16:04 ` [PATCH AUTOSEL 5.10 39/46] Bluetooth: Collect kcov coverage from hci_rx_work Sasha Levin
2022-08-11 16:04 ` [PATCH AUTOSEL 5.10 40/46] bpf/selftests: Fix couldn't retrieve pinned program in xdp veth test Sasha Levin
2022-08-11 16:04 ` [PATCH AUTOSEL 5.10 41/46] net: ethernet: stmicro: stmmac: first disable all queues and disconnect in release Sasha Levin
2022-08-11 16:04 ` [PATCH AUTOSEL 5.10 42/46] wifi: rtl8xxxu: Fix the error handling of the probe function Sasha Levin
2022-08-12 19:06 ` [PATCH AUTOSEL 5.10 01/46] drm/r128: Fix undefined behavior due to shift overflowing the constant Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220811160421.1539956-16-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=andrew@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=f.fainelli@gmail.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@rempel-privat.de \
--cc=netdev@vger.kernel.org \
--cc=o.rempel@pengutronix.de \
--cc=olteanv@gmail.com \
--cc=pabeni@redhat.com \
--cc=rmk+kernel@armlinux.org.uk \
--cc=sean.anderson@seco.com \
--cc=stable@vger.kernel.org \
--cc=vivien.didelot@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox