mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-23 02:54:32 +08:00
2a671f77ee
The struct pci_dev uses reference counting but zPCI assumed erroneously that the last reference would always be the local reference after calling pci_stop_and_remove_bus_device(). This is usually the case but not how reference counting works and thus inherently fragile. In fact one case where this causes a NULL pointer dereference when on an SRIOV device the function 0 was hot unplugged before another function of the same multi-function device. In this case the second function's pdev->sriov->dev reference keeps the struct pci_dev of function 0 alive even after the unplug. This bug was previously hidden by the fact that we were leaking the struct pci_dev which in turn means that it always outlived the struct zpci_dev. This was fixed in commit0b13525c20("s390/pci: fix leak of PCI device structure") exposing the broken behavior. Fix this by accounting for the long living reference a struct pci_dev has to its underlying struct zpci_dev via the zbus->function[] array and only release that in pcibios_release_device() ensuring that the struct pci_dev is not left with a dangling reference. This is a minimal fix in the future it would probably better to use fine grained reference counting for struct zpci_dev. Fixes:05bc1be6db("s390/pci: create zPCI bus") Cc: stable@vger.kernel.org Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
43 lines
1.1 KiB
C
43 lines
1.1 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Copyright IBM Corp. 2020
|
|
*
|
|
* Author(s):
|
|
* Pierre Morel <pmorel@linux.ibm.com>
|
|
*
|
|
*/
|
|
|
|
int zpci_bus_device_register(struct zpci_dev *zdev, struct pci_ops *ops);
|
|
void zpci_bus_device_unregister(struct zpci_dev *zdev);
|
|
|
|
int zpci_bus_scan_bus(struct zpci_bus *zbus);
|
|
void zpci_bus_scan_busses(void);
|
|
|
|
int zpci_bus_scan_device(struct zpci_dev *zdev);
|
|
void zpci_bus_remove_device(struct zpci_dev *zdev, bool set_error);
|
|
|
|
void zpci_release_device(struct kref *kref);
|
|
static inline void zpci_zdev_put(struct zpci_dev *zdev)
|
|
{
|
|
kref_put(&zdev->kref, zpci_release_device);
|
|
}
|
|
|
|
static inline void zpci_zdev_get(struct zpci_dev *zdev)
|
|
{
|
|
kref_get(&zdev->kref);
|
|
}
|
|
|
|
int zpci_alloc_domain(int domain);
|
|
void zpci_free_domain(int domain);
|
|
int zpci_setup_bus_resources(struct zpci_dev *zdev,
|
|
struct list_head *resources);
|
|
|
|
static inline struct zpci_dev *get_zdev_by_bus(struct pci_bus *bus,
|
|
unsigned int devfn)
|
|
{
|
|
struct zpci_bus *zbus = bus->sysdata;
|
|
|
|
return (devfn >= ZPCI_FUNCTIONS_PER_BUS) ? NULL : zbus->function[devfn];
|
|
}
|
|
|