diff options
| author | Ahsan Atta <ahsan.atta@intel.com> | 2026-10-06 16:06:47 +0100 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2026-10-15 20:37:52 +1100 |
| commit | 4ad7c1bd5f3dcd3fd6efbb068d6ee2a68dddfece (patch) | |
| tree | fdac769b75b32fd332af98ae66fba8f721a373f2 | |
| parent | 9260491bbfa6037067ca02002ff0f6195efaea4f (diff) | |
crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev()
state_lock is initialised at the end of adf_devmgr_add_dev(), but the VF
on host path whose id mapping already exists returns earlier via
'goto unlock'. That mapping outlives the VF, so this path is taken every
time a VF is recreated on a BDF that already hosted one, e.g.:
echo 0 > sriov_numvfs
echo 32 > sriov_numvfs
accel_dev is freshly allocated on each probe, so state_lock is left zeroed
and adf_dev_up() takes an uninitialised mutex. With CONFIG_DEBUG_MUTEXES
this is reported on a dh895xcc with 32 host-bound VFs:
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c0
Call Trace:
adf_dev_up+0x27/0xe0 [intel_qat]
adf_probe+0x700/0xa80 [qat_dh895xccvf]
local_pci_probe+0xd5/0x190
The same happens on teardown when adf_dev_down() locks it again.
Initialise the lock next to the other per-device state, before the tables
are updated, so it is done on every path.
Fixes: 1bdc85550a2b ("crypto: qat - fix concurrency issue when device state changes")
Cc: stable@vger.kernel.org
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| -rw-r--r-- | drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c index 161863841a52..26b40dd59965 100644 --- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c +++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c @@ -137,6 +137,7 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev, mutex_lock(&table_lock); atomic_set(&accel_dev->ref_count, 0); + mutex_init(&accel_dev->state_lock); /* PF on host or VF on guest - optimized to remove redundant is_vf */ if (!accel_dev->is_vf || !pf) { @@ -210,7 +211,6 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev, map->attached = true; list_add_tail(&map->list, &vfs_table); } - mutex_init(&accel_dev->state_lock); unlock: mutex_unlock(&table_lock); return ret; |