github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

hisi_acc_vfio_pci: fix NULL dereference in reset_prepare on PF passthrough

Browse Source 
When a PF is bound to the driver via driver_override and passed
through to a VM, its pf_qm stays NULL. The PCI error handler
reset_prepare() runs during open_device through
pci_try_reset_function(), before the mig_ops gate, and dereferences
the NULL pf_qm for the timeout log, crashing the kernel.

Move the mig_ops check to the entry of reset_prepare() and
aer_reset_done() so non-migration devices skip the QM_RESETTING
coordination. The dev local resolved &qm->pdev->dev before the
gate, so open code it at the dev_err() call where qm is known
valid. Also clear set_reset_flag together with QM_RESETTING in
aer_reset_done(); the flag was never cleared before, so a later
timed-out reset could release a foreign lock.

Fixes: b0eed08590 ("hisi_acc_vfio_pci: Add support for VFIO live migration")
Fixes: a22099ed79 ("hisi_acc_vfio_pci: fix VF reset timeout issue")
Signed-off-by: Longfang Liu <liulongfang@huawei.com>
Link: https://lore.kernel.org/r/20261013071929.3988687-2-liulongfang@huawei.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
This commit is contained in:
Longfang Liu 2026-10-13 15:19:28 +08:00 committed by Alex Williamson
parent 6a5f427bee
commit e1d2d60b1f
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
View File

@ -1154,14 +1154,16 @@ static void hisi_acc_vf_pci_reset_prepare(struct pci_dev *pdev)
{
struct hisi_acc_vf_core_device *hisi_acc_vdev = hisi_acc_drvdata(pdev);
struct hisi_qm *qm = hisi_acc_vdev->pf_qm;
struct device *dev = &qm->pdev->dev;
u32 delay = 0;
if (!hisi_acc_vdev->core_device.vdev.mig_ops)
return;
/* All reset requests need to be queued for processing */
while (test_and_set_bit(QM_RESETTING, &qm->misc_ctl)) {
msleep(1);
if (++delay > QM_RESET_WAIT_TIMEOUT) {
dev_err(dev, "reset prepare failed\n");
dev_err(&qm->pdev->dev, "reset prepare failed\n");
return;
}
}
@ -1174,12 +1176,14 @@ static void hisi_acc_vf_pci_aer_reset_done(struct pci_dev *pdev)
struct hisi_acc_vf_core_device *hisi_acc_vdev = hisi_acc_drvdata(pdev);
struct hisi_qm *qm = hisi_acc_vdev->pf_qm;
if (hisi_acc_vdev->set_reset_flag)
clear_bit(QM_RESETTING, &qm->misc_ctl);
if (!hisi_acc_vdev->core_device.vdev.mig_ops)
return;
if (hisi_acc_vdev->set_reset_flag) {
clear_bit(QM_RESETTING, &qm->misc_ctl);
hisi_acc_vdev->set_reset_flag = false;
}
mutex_lock(&hisi_acc_vdev->state_mutex);
hisi_acc_vf_reset(hisi_acc_vdev);
mutex_unlock(&hisi_acc_vdev->state_mutex);