Re: [PATCH 1/6] dmaengine: plx_dma: don't call pci_irq_vector() under rcu_read_lock()

[Frank Li]

On Tue, Nov 03, 2026 at 09:51:56AM -0600, Logan Gunthorpe wrote:
> plx_dma_free_chan_resources() calls pci_irq_vector() inside an RCU
> read-side section, but msi_domain_get_virq() takes the mutex that
> protects the device's MSI descriptors. Releasing a channel, for example
> at the end of a dmatest run, triggers:
>
>   BUG: sleeping function called from invalid context at kernel/locking/mutex.c:623
>   ...
>   RCU nest depth: 1, expected: 0
>   Call Trace:
>    __mutex_lock+0x113/0x2350
>    msi_domain_get_virq+0x227/0x2f0
>    pci_irq_vector+0x9a/0xc0
>    plx_dma_free_chan_resources+0x178/0x58f [plx_dma]
>    dma_chan_put+0x157/0x380
>    dma_release_channel+0xac/0x2e0
>
> Store the IRQ number at probe time and use it everywhere
> pci_irq_vector() was called, so the teardown path no longer needs to
> look it up.
>
> Fixes: c2dbcaa8c672 ("dmaengine: plx-dma: Implement hardware initialization and cleanup")
> Signed-off-by: Logan Gunthorpe <logang@xxxxxxxxxxxx>
> ---

Reviewed-by: Frank Li <Frank.Li@xxxxxxx>

>  drivers/dma/plx_dma.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c
> index 409898e92c32..0a7ad2473cb1 100644
> --- a/drivers/dma/plx_dma.c
> +++ b/drivers/dma/plx_dma.c
> @@ -104,6 +104,7 @@ struct plx_dma_dev {
>  	struct dma_device dma_dev;
>  	struct dma_chan dma_chan;
>  	struct pci_dev __rcu *pdev;
> +	int irq;
>  	void __iomem *bar;
>  	struct tasklet_struct desc_task;
>
> @@ -452,7 +453,6 @@ static void plx_dma_free_chan_resources(struct dma_chan *chan)
>  {
>  	struct plx_dma_dev *plxdev = chan_to_plx_dma_dev(chan);
>  	size_t ring_sz = PLX_DMA_RING_COUNT * sizeof(*plxdev->hw_ring);
> -	struct pci_dev *pdev;
>  	int irq = -1;
>  	int i;
>
> @@ -463,9 +463,8 @@ static void plx_dma_free_chan_resources(struct dma_chan *chan)
>  	plx_dma_stop(plxdev);
>
>  	rcu_read_lock();
> -	pdev = rcu_dereference(plxdev->pdev);
> -	if (pdev)
> -		irq = pci_irq_vector(pdev, 0);
> +	if (rcu_dereference(plxdev->pdev))
> +		irq = plxdev->irq;
>  	rcu_read_unlock();
>
>  	if (irq > 0)
> @@ -510,8 +509,9 @@ static int plx_dma_create(struct pci_dev *pdev)
>  	RCU_INIT_POINTER(plxdev->pdev, pdev);
>  	plxdev->bar = pcim_iomap_table(pdev)[0];
>
> -	rc = request_irq(pci_irq_vector(pdev, 0), plx_dma_isr, 0,
> -			 KBUILD_MODNAME, plxdev);
> +	plxdev->irq = pci_irq_vector(pdev, 0);
> +
> +	rc = request_irq(plxdev->irq, plx_dma_isr, 0, KBUILD_MODNAME, plxdev);
>  	if (rc)
>  		goto free_plx;
>
> @@ -545,7 +545,7 @@ static int plx_dma_create(struct pci_dev *pdev)
>
>  put_device:
>  	put_device(&pdev->dev);
> -	free_irq(pci_irq_vector(pdev, 0),  plxdev);
> +	free_irq(plxdev->irq, plxdev);
>  free_plx:
>  	kfree(plxdev);
>
> @@ -594,7 +594,7 @@ static void plx_dma_remove(struct pci_dev *pdev)
>  {
>  	struct plx_dma_dev *plxdev = pci_get_drvdata(pdev);
>
> -	free_irq(pci_irq_vector(pdev, 0),  plxdev);
> +	free_irq(plxdev->irq, plxdev);
>
>  	rcu_assign_pointer(plxdev->pdev, NULL);
>  	synchronize_rcu();
> --
> 2.47.3
>