Re: [PATCH v15 1/5] PCI/IOV: Make pci_lock_rescan_remove() reentrant and protect sriov_add_vfs/sriov_del_vfs

[Niklas Schnelle <schnelle@linux.ibm.com>]

On Thu, 2026-09-24 at 18:29 +0200, Benjamin Block wrote:
> From: Ionut Nechita <ionut.nechita@windriver.com>
> 
> After reverting commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove
> locking when enabling/disabling SR-IOV") and moving the lock to
> sriov_numvfs_store(), the path through driver .remove() (e.g. rmmod,
> or manual unbind) that calls pci_disable_sriov() directly remains
> unprotected against concurrent hotplug events. This affects any SR-IOV
> capable driver that calls pci_disable_sriov() from its .remove()
> callback (i40e, ice, mlx5, bnxt, etc.).
> 
> On s390, platform-generated hot-unplug events for VFs can race with
> sriov_del_vfs() when a PF driver is being unloaded. The platform event
> handler takes pci_rescan_remove_lock, but sriov_del_vfs() does not,
> leading to double removal and list corruption.
> 
> We cannot use a plain mutex_lock() here because sriov_del_vfs() may also
> be called from paths that already hold pci_rescan_remove_lock (e.g.
> remove_store -> pci_stop_and_remove_bus_device_locked, or
> sriov_numvfs_store with the lock taken by the previous patch). Using
> mutex_lock() in those cases would deadlock.
> 
> Make pci_lock_rescan_remove() itself reentrant by tracking the current
> owner task and a recursion depth counter, as suggested by Lukas Wunner
> and Benjamin Block, since these recursive locking scenarios exist
> elsewhere in the PCI subsystem:
>  - If the lock is already held by the current task (owner == current):
>    increments the depth counter and returns without re-acquiring,
>    avoiding deadlock.
>  - If the lock is held by another task: blocks until the lock is
>    released, then records the owner and sets depth to 1.
>  - If the lock is not held: acquires the mutex normally.
> 
> pci_unlock_rescan_remove() decrements the depth counter and releases
> the mutex (clearing the owner) only when the depth reaches zero.
> A WARN_ON catches mismatched unlock calls from tasks that do not own
> the lock.
> 
> This avoids relying on mutex_get_owner(), which is not exported to
> modules and caused link failures for builds that inline this code
> outside of the core kernel image.
> 
> This approach keeps the API unchanged: callers simply pair lock/unlock
> calls without needing to track any return value or use separate
> reentrant variants.
> 
> Add pci_lock_rescan_remove()/pci_unlock_rescan_remove() calls to
> sriov_add_vfs() and sriov_del_vfs() to protect VF addition and
> removal against concurrent hotplug events.
> 
> Remove the rescan/remove locking from sriov_numvfs_store() that was
> introduced by commit a5338e365c45 ("PCI/IOV: Fix race between SR-IOV
> enable/disable and hotplug"), since the locking is now handled directly
> in sriov_add_vfs() and sriov_del_vfs() where it is actually needed,
> reducing the lock scope.
> 
> Fixes: 18f9e9d150fc ("PCI/IOV: Factor out sriov_add_vfs()")
> Fixes: 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV")
> Fixes: a5338e365c45 ("PCI/IOV: Fix race between SR-IOV enable/disable and hotplug")
> Cc: stable@vger.kernel.org
> Suggested-by: Lukas Wunner <lukas@wunner.de>
> Suggested-by: Benjamin Block <bblock@linux.ibm.com>
> Signed-off-by: Ionut Nechita <ionut.nechita@windriver.com>
> [bblock@linux.ibm.com: rebase on v7.3, READ_/WRITE_ONCE changes, comments]
> Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
> ---
>  drivers/pci/iov.c   |  9 +++++----
>  drivers/pci/probe.c | 27 +++++++++++++++++++++++++--
>  2 files changed, 30 insertions(+), 6 deletions(-)

Thanks for taking over from Ionut and refusing to give up on this. I
don't love needing a reentrant lock, but it seems like the simplest,
and most contained solution to a real problem until such time as a full
rework of the pci_rescan_remove lock comes up. It also feels easy
enough to understand and the added WARN_ON() should catch the double
unlock case. Also both upstream sashiko and my own LLM reviews with
multiple models are all happy with this.

So I think we should go ahead with this and feel free to add my:

Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>

Thanks,
Niklas