public inbox for [email protected]
 help / color / mirror / Atom feed
From: "zhanghongtao (A)" <[email protected]>
To: Greg KH <[email protected]>
Cc: <[email protected]>, <[email protected]>,
	<[email protected]>, <[email protected]>,
	<[email protected]>
Subject: Re: [PATCH] drivers:uio: Fix system crashes during driver switchover
Date: Wed, 11 May 2022 16:51:11 +0800	[thread overview]
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>

Thanks for your reply.
I looked through the historical emails and thought I was not the
same problem as his.
After the driver is switched, the application can still operate
on the mapped address, which causes the system to crash.
The application is not aware of the driver's switchover.
The solution I can think of is to block the switch and wait for
the application to release before switching, as shown in the patch.
So want to seek help from the community, how to solve it better?
Is there a better way?

在 2022/5/11 14:48, Greg KH 写道:
> On Wed, May 11, 2022 at 02:34:28PM +0800, zhanghongtao (A) wrote:
>> From: Hongtao Zhang <[email protected]>
>>
>> Switch the driver of the SPDK program that is being read and written from the uio_pci_generic driver to the NVMe driver
>> (Unbind the UIO driver from the device and bind the NVMe driver to the device.) ,the system crashes and restarts.
>> Bug reproduction: When the SPDK is reading or writing data, run the following command: /opt/spdk/setup.sh reset
> 
> Please properly wrap your lines at 72 columns like the editor asked you
> to.
> 
>> The one with a higher probability of occurrence is as follows:
>> PANIC: "BUG: unable to handle kernel NULL pointer dereference at 0000000000000008"
>>     [exception RIP: _raw_spin_lock_irqsave+30]
>>     RIP: ffffffff836a1cae  RSP: ffff8bca9ecc3f20  RFLAGS: 00010046
>>     RAX: 0000000000000000  RBX: 0000000000000246  RCX: 0000000000000017
>>     RDX: 0000000000000001  RSI: 0000000000000000  RDI: 0000000000000008
>>     RBP: 0000000000000000   R8: 000000afb34e50f9   R9: 0000000000000000
>>     R10: 0000000000000000  R11: 0000000000000000  R12: ffff8bca9ecc3f50
>>     R13: 0000000000000004  R14: 0000000000000004  R15: 0000000000000000
>>     ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
>>  #7 [ffff8bca9ecc3f28] complete at ffffffff82f09bb8
>> reason:After the driver switchover, the upper-layer program can still access the bar space of the NVMe disk controller and knock the doorbell.
>> To solve this problem, a reference counting is added to prevent unbind execution before the application is closed or exited.
>>
>> Signed-off-by: Hongtao Zhang <[email protected]>
>> Reviewed-by: Weifeng Su <[email protected]>
>> ---
>>  drivers/uio/uio.c          | 13 +++++++++++++
>>  include/linux/uio_driver.h |  1 +
>>  2 files changed, 14 insertions(+)
>>
>> diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
>> index 43afbb7c5ab9..cb8ed29a8648 100644
>> --- a/drivers/uio/uio.c
>> +++ b/drivers/uio/uio.c
>> @@ -31,6 +31,7 @@ static int uio_major;
>>  static struct cdev *uio_cdev;
>>  static DEFINE_IDR(uio_idr);
>>  static const struct file_operations uio_fops;
>> +static DECLARE_WAIT_QUEUE_HEAD(refc_wait);
>>
>>  /* Protect idr accesses */
>>  static DEFINE_MUTEX(minor_lock);
>> @@ -501,6 +502,7 @@ static int uio_open(struct inode *inode, struct file *filep)
>>  	mutex_unlock(&idev->info_lock);
>>  	if (ret)
>>  		goto err_infoopen;
>> +	refcount_inc(&idev->dev_refc);
>>
>>  	return 0;
>>
>> @@ -536,6 +538,9 @@ static int uio_release(struct inode *inode, struct file *filep)
>>  		ret = idev->info->release(idev->info, inode);
>>  	mutex_unlock(&idev->info_lock);
>>
>> +	if (refcount_dec_and_test(&idev->dev_refc))
>> +			wake_up(&refc_wait);
>> +
>>  	module_put(idev->owner);
>>  	kfree(listener);
>>  	put_device(&idev->dev);
>> @@ -937,6 +942,7 @@ int __uio_register_device(struct module *owner,
>>
>>  	idev->owner = owner;
>>  	idev->info = info;
>> +	refcount_set(&idev->dev_refc, 0);
>>  	mutex_init(&idev->info_lock);
>>  	init_waitqueue_head(&idev->wait);
>>  	atomic_set(&idev->event, 0);
>> @@ -1045,6 +1051,7 @@ void uio_unregister_device(struct uio_info *info)
>>  {
>>  	struct uio_device *idev;
>>  	unsigned long minor;
>> +	unsigned int dref_count;
>>
>>  	if (!info || !info->uio_dev)
>>  		return;
>> @@ -1052,6 +1059,12 @@ void uio_unregister_device(struct uio_info *info)
>>  	idev = info->uio_dev;
>>  	minor = idev->minor;
>>
>> +	dref_count = refcount_read(&idev->dev_refc);
>> +	if (dref_count > 0) {
> 
> You can not do this, it could have changed right after reading this.
> 
> Also we went through this many times in the past already, why submit
> this type of change again?
> 
> thanks,
> 
> greg k-h
> .


  reply	other threads:[~2022-05-11  8:51 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-11  6:34 [PATCH] drivers:uio: Fix system crashes during driver switchover zhanghongtao (A)
2022-05-11  6:48 ` Greg KH
2022-05-11  8:51   ` zhanghongtao (A) [this message]
2022-05-11 10:09     ` Greg KH
2022-05-17  7:34     ` Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox