Messages in this thread | | | Subject | Re: [PATCH v2 01/11] iommu/iova: Fix race between FQ timeout and teardown | From | John Garry <> | Date | Fri, 10 Dec 2021 18:04:53 +0000 |
| |
On 10/12/2021 17:54, Robin Murphy wrote: > From: Xiongfeng Wang<wangxiongfeng2@huawei.com> > > It turns out to be possible for hotplugging out a device to reach the > stage of tearing down the device's group and default domain before the > domain's flush queue has drained naturally. At this point, it is then > possible for the timeout to expire just*before* the del_timer() call
super nit: "just*before* the" - needs a whitespace before "before" :)
> from free_iova_flush_queue(), such that we then proceed to free the FQ > resources while fq_flush_timeout() is still accessing them on another > CPU. Crashes due to this have been observed in the wild while removing > NVMe devices. > > Close the race window by using del_timer_sync() to safely wait for any > active timeout handler to finish before we start to free things. We > already avoid any locking in free_iova_flush_queue() since the FQ is > supposed to be inactive anyway, so the potential deadlock scenario does > not apply. > > Fixes: 9a005a800ae8 ("iommu/iova: Add flush timer") > Signed-off-by: Xiongfeng Wang<wangxiongfeng2@huawei.com> > [ rm: rewrite commit message ] > Signed-off-by: Robin Murphy<robin.murphy@arm.com>
FWIW,
Reviewed-by: John Garry <john.garry@huawei.com>
| |