libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock [Linux 4.19.66]

This Linux kernel change "libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock" is included in the Linux 4.19.66 release. This change is authored by Dan Williams <dan.j.williams [at]> on Mon Aug 5 18:32:13 2019 -0700. The commit for this change in Linux stable tree is 2364ed0 (patch) which is from upstream commit ca6bf26. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream ca6bf26.

libnvdimm/bus: Fix wait_nvdimm_bus_probe_idle() ABBA deadlock

commit ca6bf264f6d856f959c4239cda1047b587745c67 upstream.

A multithreaded namespace creation/destruction stress test currently
deadlocks with the following lockup signature:

    INFO: task ndctl:2924 blocked for more than 122 seconds.
          Tainted: G           OE     5.2.0-rc4+ #3382
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    ndctl           D    0  2924   1176 0x00000000
    Call Trace:
     ? __schedule+0x27e/0x780
     wait_nvdimm_bus_probe_idle+0x8a/0xd0 [libnvdimm]
     ? finish_wait+0x80/0x80
     uuid_store+0xe6/0x2e0 [libnvdimm]

     INFO: task ndctl:2923 blocked for more than 122 seconds.
           Tainted: G           OE     5.2.0-rc4+ #3382
     "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
     ndctl           D    0  2923   1175 0x00000000
     Call Trace:
      ? __schedule+0x27e/0x780
      ? __mutex_lock+0x489/0x910
      ? nvdimm_namespace_common_probe+0x95/0x4d0 [libnvdimm]
      ? __lock_acquire+0x23f/0x1710
      ? nvdimm_namespace_common_probe+0x95/0x4d0 [libnvdimm]
      nvdimm_namespace_common_probe+0x95/0x4d0 [libnvdimm]
      __dax_pmem_probe+0x5e/0x210 [dax_pmem_core]
      ? nvdimm_bus_probe+0x1d0/0x2c0 [libnvdimm]
      dax_pmem_probe+0xc/0x20 [dax_pmem]
      nvdimm_bus_probe+0x90/0x2c0 [libnvdimm]

In this sequence an 'nd_dax' device is being probed and trying to take
the lock on its backing namespace to validate that the 'nd_dax' device
indeed has exclusive access to the backing namespace. Meanwhile, another
thread is trying to update the uuid property of that same backing
namespace. So one thread is in the probe path trying to acquire the
lock, and the other thread has acquired the lock and tries to flush the
probe path.

Fix this deadlock by not holding the namespace device_lock over the
wait_nvdimm_bus_probe_idle() synchronization step. In turn this requires
the device_lock to be held on entry to wait_nvdimm_bus_probe_idle() and
subsequently dropped internally to wait_nvdimm_bus_probe_idle().

Cc: <>
Fixes: bf9bccc14c05 ("libnvdimm: pmem label sets and namespace instantiation")
Cc: Vishal Verma <>
Tested-by: Jane Chu <>
Signed-off-by: Dan Williams <>
Signed-off-by: Sasha Levin <>

There are 18 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/nvdimm/bus.c         | 14 +++++++++-----
 drivers/nvdimm/region_devs.c |  4 ++++
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 5abcdb4..2ba22cd 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -865,10 +865,12 @@ void wait_nvdimm_bus_probe_idle(struct device *dev)
    do {
        if (nvdimm_bus->probe_active == 0)
-       nvdimm_bus_unlock(&nvdimm_bus->dev);
+       nvdimm_bus_unlock(dev);
+       device_unlock(dev);
                nvdimm_bus->probe_active == 0);
-       nvdimm_bus_lock(&nvdimm_bus->dev);
+       device_lock(dev);
+       nvdimm_bus_lock(dev);
    } while (true);

@@ -994,7 +996,7 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
        case ND_CMD_ARS_START:
        case ND_CMD_CLEAR_ERROR:
        case ND_CMD_CALL:
-           dev_dbg(&nvdimm_bus->dev, "'%s' command while read-only.\n",
+           dev_dbg(dev, "'%s' command while read-only.\n",
                    nvdimm ? nvdimm_cmd_name(cmd)
                    : nvdimm_bus_cmd_name(cmd));
            return -EPERM;
@@ -1083,7 +1085,8 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
        goto out;

-   nvdimm_bus_lock(&nvdimm_bus->dev);
+   device_lock(dev);
+   nvdimm_bus_lock(dev);
    rc = nd_cmd_clear_to_send(nvdimm_bus, nvdimm, func, buf);
    if (rc)
        goto out_unlock;
@@ -1103,7 +1106,8 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
        rc = -EFAULT;

-   nvdimm_bus_unlock(&nvdimm_bus->dev);
+   nvdimm_bus_unlock(dev);
+   device_unlock(dev);
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index e7377f1..0303296 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -425,10 +425,12 @@ static ssize_t available_size_show(struct device *dev,
     * memory nvdimm_bus_lock() is dropped, but that's userspace's
     * problem to not race itself.
+   device_lock(dev);
    available = nd_region_available_dpa(nd_region);
+   device_unlock(dev);

    return sprintf(buf, "%llu\n", available);
@@ -440,10 +442,12 @@ static ssize_t max_available_extent_show(struct device *dev,
    struct nd_region *nd_region = to_nd_region(dev);
    unsigned long long available = 0;

+   device_lock(dev);
    available = nd_region_allocatable_dpa(nd_region);
+   device_unlock(dev);

    return sprintf(buf, "%llu\n", available);

Leave a Reply

Your email address will not be published. Required fields are marked *