The lock management in the nfp_alloc_bar function is problematic:
*1. The function acquires the lock at the beginning:
spin_lock_irqsave(&nfp->bar_lock, irqflags).
2. When barnum < 0 and in non-blocking mode, the code jumps to
the err_nobar label. However, in this non-blocking path, if
barnum < 0, the code releases the lock and calls nfp_wait_for_bar.
3. Inside nfp_wait_for_bar, find_unused_bar_and_lock is called,
which holds the lock upon success (indicated by the __release
annotation). Consequently, when nfp_wait_for_bar returns
successfully, the lock is still held.
4. But at the err_nobar label, the code always executes
spin_unlock_irqrestore(&nfp->bar_lock, irqflags).
5. The problem arises when nfp_wait_for_bar successfully finds a
BAR: the lock is still held, but if a subsequent reconfigure_bar
fails, the code will attempt to unlock it again at err_nobar,
leading to a double unlock.
Reported-by: Jun Zhan <redacted>
Co-developed-by: Chen Linxuan <redacted>
Signed-off-by: Chen Linxuan <redacted>
Signed-off-by: WangYuli <redacted>
---
drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c | 1 +
1 file changed, 1 insertion(+)
From: Jakub Kicinski <kuba@kernel.org> Date: 2025-06-23 20:11:42
On Mon, 23 Jun 2025 12:11:04 +0800 WangYuli wrote:
The lock management in the nfp_alloc_bar function is problematic:
*1. The function acquires the lock at the beginning:
spin_lock_irqsave(&nfp->bar_lock, irqflags).
2. When barnum < 0 and in non-blocking mode, the code jumps to
the err_nobar label. However, in this non-blocking path, if
barnum < 0, the code releases the lock and calls nfp_wait_for_bar.
3. Inside nfp_wait_for_bar, find_unused_bar_and_lock is called,
which holds the lock upon success (indicated by the __release
annotation). Consequently, when nfp_wait_for_bar returns
successfully, the lock is still held.
4. But at the err_nobar label, the code always executes
spin_unlock_irqrestore(&nfp->bar_lock, irqflags).
5. The problem arises when nfp_wait_for_bar successfully finds a
BAR: the lock is still held, but if a subsequent reconfigure_bar
fails, the code will attempt to unlock it again at err_nobar,
leading to a double unlock.
I don't understand what you're trying to say.
If you think your analysis is correct please provide a more exact
execution path with a code listing.
--
pw-bot: cr
On Tue, Jun 24, 2025 at 4:12 AM Jakub Kicinski [off-list ref] wrote:
On Mon, 23 Jun 2025 12:11:04 +0800 WangYuli wrote:
quoted
The lock management in the nfp_alloc_bar function is problematic:
*1. The function acquires the lock at the beginning:
spin_lock_irqsave(&nfp->bar_lock, irqflags).
2. When barnum < 0 and in non-blocking mode, the code jumps to
the err_nobar label. However, in this non-blocking path, if
barnum < 0, the code releases the lock and calls nfp_wait_for_bar.
3. Inside nfp_wait_for_bar, find_unused_bar_and_lock is called,
which holds the lock upon success (indicated by the __release
annotation). Consequently, when nfp_wait_for_bar returns
successfully, the lock is still held.
4. But at the err_nobar label, the code always executes
spin_unlock_irqrestore(&nfp->bar_lock, irqflags).
5. The problem arises when nfp_wait_for_bar successfully finds a
BAR: the lock is still held, but if a subsequent reconfigure_bar
fails, the code will attempt to unlock it again at err_nobar,
leading to a double unlock.
I don't understand what you're trying to say.
If you think your analysis is correct please provide a more exact
execution path with a code listing.
In nfp_alloc_bar(), if
- find_matching_bar() fails to find a bar
- find_unused_bar_noblock also fails to find a bar
- nonblocking == false
- nfp_wait_for_bar returns 0
In this situation, when executing nfp_bar_get(nfp, &nfp->bar[barnum]),
the code does not hold &nfp->bar_lock.
We referred to similar logic in other drivers:
https://elixir.bootlin.com/linux/v6.13/source/sound/usb/line6/driver.c#L565
It seems that a lock should be acquired here again.
On Tue, Jul 1, 2025 at 3:45 PM Chen Linxuan [off-list ref] wrote:
On Tue, Jun 24, 2025 at 4:12 AM Jakub Kicinski [off-list ref] wrote:
quoted
On Mon, 23 Jun 2025 12:11:04 +0800 WangYuli wrote:
quoted
The lock management in the nfp_alloc_bar function is problematic:
*1. The function acquires the lock at the beginning:
spin_lock_irqsave(&nfp->bar_lock, irqflags).
2. When barnum < 0 and in non-blocking mode, the code jumps to
the err_nobar label. However, in this non-blocking path, if
barnum < 0, the code releases the lock and calls nfp_wait_for_bar.
3. Inside nfp_wait_for_bar, find_unused_bar_and_lock is called,
which holds the lock upon success (indicated by the __release
annotation). Consequently, when nfp_wait_for_bar returns
successfully, the lock is still held.
4. But at the err_nobar label, the code always executes
spin_unlock_irqrestore(&nfp->bar_lock, irqflags).
5. The problem arises when nfp_wait_for_bar successfully finds a
BAR: the lock is still held, but if a subsequent reconfigure_bar
fails, the code will attempt to unlock it again at err_nobar,
leading to a double unlock.
I don't understand what you're trying to say.
If you think your analysis is correct please provide a more exact
execution path with a code listing.
In nfp_alloc_bar(), if
- find_matching_bar() fails to find a bar
- find_unused_bar_noblock also fails to find a bar
- nonblocking == false
- nfp_wait_for_bar returns 0
In this situation, when executing nfp_bar_get(nfp, &nfp->bar[barnum]),
the code does not hold &nfp->bar_lock.
We referred to similar logic in other drivers:
https://elixir.bootlin.com/linux/v6.13/source/sound/usb/line6/driver.c#L565
It seems that a lock should be acquired here again.
Sorry, I found that find_unused_bar_and_lock already re-locks it. I
didn't notice it before. Please ignore the entire thread.