From 4ad7c1bd5f3dcd3fd6efbb068d6ee2a68dddfece Mon Sep 17 00:00:00 2001 From: Ahsan Atta Date: Tue, 6 Oct 2026 16:06:47 +0100 Subject: crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev() state_lock is initialised at the end of adf_devmgr_add_dev(), but the VF on host path whose id mapping already exists returns earlier via 'goto unlock'. That mapping outlives the VF, so this path is taken every time a VF is recreated on a BDF that already hosted one, e.g.: echo 0 > sriov_numvfs echo 32 > sriov_numvfs accel_dev is freshly allocated on each probe, so state_lock is left zeroed and adf_dev_up() takes an uninitialised mutex. With CONFIG_DEBUG_MUTEXES this is reported on a dh895xcc with 32 host-bound VFs: DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: kernel/locking/mutex.c:159 at mutex_lock+0x171/0x1c0 Call Trace: adf_dev_up+0x27/0xe0 [intel_qat] adf_probe+0x700/0xa80 [qat_dh895xccvf] local_pci_probe+0xd5/0x190 The same happens on teardown when adf_dev_down() locks it again. Initialise the lock next to the other per-device state, before the tables are updated, so it is done on every path. Fixes: 1bdc85550a2b ("crypto: qat - fix concurrency issue when device state changes") Cc: stable@vger.kernel.org Signed-off-by: Ahsan Atta Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu --- drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c index 161863841a52..26b40dd59965 100644 --- a/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c +++ b/drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c @@ -137,6 +137,7 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev, mutex_lock(&table_lock); atomic_set(&accel_dev->ref_count, 0); + mutex_init(&accel_dev->state_lock); /* PF on host or VF on guest - optimized to remove redundant is_vf */ if (!accel_dev->is_vf || !pf) { @@ -210,7 +211,6 @@ int adf_devmgr_add_dev(struct adf_accel_dev *accel_dev, map->attached = true; list_add_tail(&map->list, &vfs_table); } - mutex_init(&accel_dev->state_lock); unlock: mutex_unlock(&table_lock); return ret; -- cgit v1.2.3