PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()

In the Linux kernel, the following vulnerability has been resolved:

PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store()

The sysfs sriov_numvfs_store() path acquires the device lock before the

config space access lock:

sriov_numvfs_store

device_lock # A (1) acquire device lock

sriov_configure

vfio_pci_sriov_configure # (for example)

vfio_pci_core_sriov_configure

pci_disable_sriov

sriov_disable

pci_cfg_access_lock

pci_wait_cfg # B (4) wait for dev->block_cfg_access == 0

Previously, pci_dev_lock() acquired the config space access lock before the

device lock:

pci_dev_lock

pci_cfg_access_lock

dev->block_cfg_access = 1 # B (2) set dev->block_cfg_access = 1

device_lock # A (3) wait for device lock

Any path that uses pci_dev_lock(), e.g., pci_reset_function(), may

deadlock with sriov_numvfs_store() if the operations occur in the sequence

(1) (2) (3) (4).

Avoid the deadlock by reversing the order in pci_dev_lock() so it acquires

the device lock before the config space access lock, the same as the

sriov_numvfs_store() path.

[bhelgaas: combined and adapted commit log from Jay Zhou's independent

subsequent posting:

https://lore.kernel.org/r/[email protected]]