[PATCH v1 0/1] PCI/IOV: Fix unprotected sriov_del_vfs() against concurrent hotplug

[Ionut Nechita (Wind River)]

From: Ionut Nechita <ionut.nechita@xxxxxxxxxxxxx>

After reverting commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove
locking when enabling/disabling SR-IOV") and moving the lock to
sriov_numvfs_store(), the path through driver .remove() (e.g. rmmod,
or manual unbind) that calls pci_disable_sriov() directly remains
unprotected against concurrent hotplug events. This affects any SR-IOV
capable driver that calls pci_disable_sriov() from its .remove()
callback (i40e, ice, mlx5, bnxt, etc.).

On s390, platform-generated hot-unplug events for VFs can race with
sriov_del_vfs() when a PF driver is being unloaded. The platform event
handler takes pci_rescan_remove_lock, but sriov_del_vfs() does not,
leading to double removal and list corruption.

This patch introduces owner tracking for pci_rescan_remove_lock via a
new pci_lock_rescan_remove_nested() helper that avoids deadlock when
called from paths that already hold the lock, while still providing
full serialization against concurrent hotplug from other tasks.

Testing:
- Code path analysis verified for all call chains involving
  sriov_add_vfs() and sriov_del_vfs().
- The race condition with platform-generated hotplug events is
  specific to s390/s390x. Testing on s390 hardware would be
  appreciated to confirm the fix addresses the original issue.

Ionut Nechita (1):
  PCI/IOV: Add nested locking in sriov_add_vfs/sriov_del_vfs for
    complete serialization

 drivers/pci/iov.c   | 10 ++++++++++
 drivers/pci/pci.h   |  1 +
 drivers/pci/probe.c | 12 ++++++++++++
 3 files changed, 23 insertions(+)

-- 
2.53.0