LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: John Garry <john.garry@huawei.com>,
	Xiang Chen <chenxiang66@hisilicon.com>,
	Robin Murphy <robin.murphy@arm.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 5.0 071/317] driver core: Postpone DMA tear-down until after devres release for probe failure
Date: Wed, 22 May 2019 15:19:32 -0400	[thread overview]
Message-ID: <20190522192338.23715-71-sashal@kernel.org> (raw)
In-Reply-To: <20190522192338.23715-1-sashal@kernel.org>

From: John Garry <john.garry@huawei.com>

[ Upstream commit 0b777eee88d712256ba8232a9429edb17c4f9ceb ]

In commit 376991db4b64 ("driver core: Postpone DMA tear-down until after
devres release"), we changed the ordering of tearing down the device DMA
ops and releasing all the device's resources; this was because the DMA ops
should be maintained until we release the device's managed DMA memories.

However, we have seen another crash on an arm64 system when a
device driver probe fails:

  hisi_sas_v3_hw 0000:74:02.0: Adding to iommu group 2
  scsi host1: hisi_sas_v3_hw
  BUG: Bad page state in process swapper/0  pfn:313f5
  page:ffff7e0000c4fd40 count:1 mapcount:0
  mapping:0000000000000000 index:0x0
  flags: 0xfffe00000001000(reserved)
  raw: 0fffe00000001000 ffff7e0000c4fd48 ffff7e0000c4fd48
0000000000000000
  raw: 0000000000000000 0000000000000000 00000001ffffffff
0000000000000000
  page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
  bad because of flags: 0x1000(reserved)
  Modules linked in:
  CPU: 49 PID: 1 Comm: swapper/0 Not tainted
5.1.0-rc1-43081-g22d97fd-dirty #1433
  Hardware name: Huawei D06/D06, BIOS Hisilicon D06 UEFI
RC0 - V1.12.01 01/29/2019
  Call trace:
  dump_backtrace+0x0/0x118
  show_stack+0x14/0x1c
  dump_stack+0xa4/0xc8
  bad_page+0xe4/0x13c
  free_pages_check_bad+0x4c/0xc0
  __free_pages_ok+0x30c/0x340
  __free_pages+0x30/0x44
  __dma_direct_free_pages+0x30/0x38
  dma_direct_free+0x24/0x38
  dma_free_attrs+0x9c/0xd8
  dmam_release+0x20/0x28
  release_nodes+0x17c/0x220
  devres_release_all+0x34/0x54
  really_probe+0xc4/0x2c8
  driver_probe_device+0x58/0xfc
  device_driver_attach+0x68/0x70
  __driver_attach+0x94/0xdc
  bus_for_each_dev+0x5c/0xb4
  driver_attach+0x20/0x28
  bus_add_driver+0x14c/0x200
  driver_register+0x6c/0x124
  __pci_register_driver+0x48/0x50
  sas_v3_pci_driver_init+0x20/0x28
  do_one_initcall+0x40/0x25c
  kernel_init_freeable+0x2b8/0x3c0
  kernel_init+0x10/0x100
  ret_from_fork+0x10/0x18
  Disabling lock debugging due to kernel taint
  BUG: Bad page state in process swapper/0  pfn:313f6
  page:ffff7e0000c4fd80 count:1 mapcount:0
mapping:0000000000000000 index:0x0
[   89.322983] flags: 0xfffe00000001000(reserved)
  raw: 0fffe00000001000 ffff7e0000c4fd88 ffff7e0000c4fd88
0000000000000000
  raw: 0000000000000000 0000000000000000 00000001ffffffff
0000000000000000

The crash occurs for the same reason.

In this case, on the really_probe() failure path, we are still clearing
the DMA ops prior to releasing the device's managed memories.

This patch fixes this issue by reordering the DMA ops teardown and the
call to devres_release_all() on the failure path.

Reported-by: Xiang Chen <chenxiang66@hisilicon.com>
Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/dd.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index d62487d024559..4add909e1a912 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -486,7 +486,7 @@ static int really_probe(struct device *dev, struct device_driver *drv)
 	if (dev->bus->dma_configure) {
 		ret = dev->bus->dma_configure(dev);
 		if (ret)
-			goto dma_failed;
+			goto probe_failed;
 	}
 
 	if (driver_sysfs_add(dev)) {
@@ -542,14 +542,13 @@ static int really_probe(struct device *dev, struct device_driver *drv)
 	goto done;
 
 probe_failed:
-	arch_teardown_dma_ops(dev);
-dma_failed:
 	if (dev->bus)
 		blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
 					     BUS_NOTIFY_DRIVER_NOT_BOUND, dev);
 pinctrl_bind_failed:
 	device_links_no_driver(dev);
 	devres_release_all(dev);
+	arch_teardown_dma_ops(dev);
 	driver_sysfs_remove(dev);
 	dev->driver = NULL;
 	dev_set_drvdata(dev, NULL);
-- 
2.20.1


  parent reply	other threads:[~2019-05-22 19:54 UTC|newest]

Thread overview: 107+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-05-22 19:18 [PATCH AUTOSEL 5.0 001/317] gfs2: Fix lru_count going negative Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 002/317] cxgb4: Fix error path in cxgb4_init_module Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 003/317] afs: Fix getting the afs.fid xattr Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 004/317] NFS: make nfs_match_client killable Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 005/317] gfs2: fix race between gfs2_freeze_func and unmount Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 006/317] IB/hfi1: Fix WQ_MEM_RECLAIM warning Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 007/317] gfs2: Fix occasional glock use-after-free Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 008/317] mmc: core: Verify SD bus width Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 009/317] batman-adv: mcast: fix multicast tt/tvlv worker locking Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 010/317] tools/bpf: fix perf build error with uClibc (seen on ARC) Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 011/317] selftests/bpf: set RLIMIT_MEMLOCK properly for test_libbpf_open.c Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 012/317] bpftool: exclude bash-completion/bpftool from .gitignore pattern Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 013/317] ice: Separate if conditions for ice_set_features() Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 014/317] blk-mq: split blk_mq_alloc_and_init_hctx into two parts Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 015/317] blk-mq: grab .q_usage_counter when queuing request from plug code path Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 016/317] dmaengine: tegra210-dma: free dma controller in remove() Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 017/317] net: ena: gcc 8: fix compilation warning Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 018/317] net: ena: fix: set freed objects to NULL to avoid failing future allocations Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 019/317] hv_netvsc: fix race that may miss tx queue wakeup Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 020/317] orangefs: truncate before updating size Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 021/317] Bluetooth: Ignore CC events not matching the last HCI command Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 022/317] pinctrl: zte: fix leaked of_node references Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 023/317] ASoC: Intel: kbl_da7219_max98357a: Map BTN_0 to KEY_PLAYPAUSE Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 024/317] usb: dwc2: gadget: Increase descriptors count for ISOC's Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 025/317] usb: dwc3: move synchronize_irq() out of the spinlock protected block Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 026/317] usb: gadget: f_fs: don't free buffer prematurely Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 027/317] ASoC: hdmi-codec: unlock the device on startup errors Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 028/317] leds: avoid races with workqueue Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 029/317] powerpc/perf: Return accordingly on invalid chip-id in Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 030/317] powerpc/boot: Fix missing check of lseek() return value Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 031/317] powerpc/perf: Fix loop exit condition in nest_imc_event_init Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 032/317] spi: atmel-quadspi: fix crash while suspending Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 033/317] ASoC: imx: fix fiq dependencies Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 034/317] spi: pxa2xx: fix SCR (divisor) calculation Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 035/317] brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler() Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 036/317] ACPI / property: fix handling of data_nodes in acpi_get_next_subnode() Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 037/317] drm/nouveau/bar/nv50: ensure BAR is mapped Sasha Levin
2019-05-22 19:18 ` [PATCH AUTOSEL 5.0 038/317] media: stm32-dcmi: return appropriate error codes during probe Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 039/317] ARM: vdso: Remove dependency with the arch_timer driver internals Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 040/317] arm64: Fix compiler warning from pte_unmap() with -Wunused-but-set-variable Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 041/317] x86/ftrace: Set trampoline pages as executable Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 042/317] powerpc/watchdog: Use hrtimers for per-CPU heartbeat Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 043/317] sched/cpufreq: Fix kobject memleak Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 044/317] scsi: qla2xxx: Fix a qla24xx_enable_msix() error path Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 045/317] scsi: qla2xxx: Fix abort handling in tcm_qla2xxx_write_pending() Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 046/317] scsi: qla2xxx: Avoid that lockdep complains about unsafe locking in tcm_qla2xxx_close_session() Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 047/317] scsi: qla2xxx: Fix hardirq-unsafe locking Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 048/317] x86/modules: Avoid breaking W^X while loading modules Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 049/317] Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 050/317] btrfs: fix panic during relocation after ENOSPC before writeback happens Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 051/317] btrfs: Don't panic when we can't find a root key Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 052/317] iwlwifi: pcie: don't crash on invalid RX interrupt Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 053/317] rtc: 88pm860x: prevent use-after-free on device remove Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 054/317] rtc: stm32: manage the get_irq probe defer case Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 055/317] scsi: qedi: Abort ep termination if offload not scheduled Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 056/317] s390/kexec_file: Fix detection of text segment in ELF loader Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 057/317] ALSA: hda: fix unregister device twice on ASoC driver Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 058/317] sched/nohz: Run NOHZ idle load balancer on HK_FLAG_MISC CPUs Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 059/317] net: ethernet: ti: cpsw: fix allmulti cfg in dual_mac mode Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 060/317] w1: fix the resume command API Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 061/317] net: hns3: fix for TX clean num when cleaning TX BD Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 062/317] net: phy: improve genphy_soft_reset Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 063/317] s390: qeth: address type mismatch warning Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 064/317] net: hns3: use atomic_t replace u32 for arq's count Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 065/317] dmaengine: pl330: _stop: clear interrupt status Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 066/317] mac80211/cfg80211: update bss channel on channel switch Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 067/317] USB: serial: fix initial-termios handling Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 068/317] libbpf: fix samples/bpf build failure due to undefined UINT32_MAX Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 069/317] slimbus: fix a potential NULL pointer dereference in of_qcom_slim_ngd_register Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 070/317] driver core: platform: Fix the usage of platform device name(pdev->name) Sasha Levin
2019-05-22 20:04   ` Greg Kroah-Hartman
2019-05-29 18:57     ` Sasha Levin
2019-05-22 19:19 ` Sasha Levin [this message]
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 072/317] ASoC: fsl_sai: Update is_slave_mode with correct value Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 073/317] Fix nfs4.2 return -EINVAL when do dedupe operation Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 074/317] mwifiex: prevent an array overflow Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 075/317] rsi: Fix NULL pointer dereference in kmalloc Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 076/317] net: cw1200: fix a NULL pointer dereference Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 077/317] at76c50x-usb: Don't register led_trigger if usb_register_driver failed Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 078/317] nvme: set 0 capacity if namespace block size exceeds PAGE_SIZE Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 079/317] nvme-rdma: fix a NULL deref when an admin connect times out Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 080/317] nvme-tcp: " Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 081/317] ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 082/317] crypto: sun4i-ss - Fix invalid calculation of hash end Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 083/317] bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 084/317] bcache: return error immediately in bch_journal_replay() Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 085/317] bcache: fix failure in journal relplay Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 086/317] bcache: add failure check to run_cache_set() for journal replay Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 087/317] bcache: avoid clang -Wunintialized warning Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 088/317] RDMA/cma: Consider scope_id while binding to ipv6 ll address Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 089/317] vfio-ccw: Do not call flush_workqueue while holding the spinlock Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 090/317] vfio-ccw: Release any channel program when releasing/removing vfio-ccw mdev Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 091/317] x86/build: Move _etext to actual end of .text Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 092/317] smpboot: Place the __percpu annotation correctly Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 093/317] x86/uaccess: Dont leak the AC flag into __put_user() argument evaluation Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 094/317] x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault() Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 095/317] mlxsw: spectrum_router: Prevent ipv6 gateway with v4 route via replace and append Sasha Levin
2019-05-22 19:27   ` David Ahern
2019-05-29 19:00     ` Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 096/317] mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 097/317] Bluetooth: hci_qca: Give enough time to ROME controller to bootup Sasha Levin
2019-05-22 19:19 ` [PATCH AUTOSEL 5.0 098/317] Bluetooth: btbcm: Add default address for BCM43341B Sasha Levin
2019-05-22 19:20 ` [PATCH AUTOSEL 5.0 099/317] HID: logitech-hidpp: use RAP instead of FAP to get the protocol version Sasha Levin
2019-05-22 19:20 ` [PATCH AUTOSEL 5.0 100/317] pinctrl: pistachio: fix leaked of_node references Sasha Levin
2019-05-22 19:20 ` [PATCH AUTOSEL 5.0 101/317] pinctrl: st: " Sasha Levin
2019-05-22 19:20 ` [PATCH AUTOSEL 5.0 102/317] pinctrl: samsung: " Sasha Levin
2019-05-22 19:20 ` [PATCH AUTOSEL 5.0 103/317] clk: rockchip: undo several noc and special clocks as critical on rk3288 Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190522192338.23715-71-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=chenxiang66@hisilicon.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=john.garry@huawei.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=robin.murphy@arm.com \
    --cc=stable@vger.kernel.org \
    --subject='Re: [PATCH AUTOSEL 5.0 071/317] driver core: Postpone DMA tear-down until after devres release for probe failure' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).