summaryrefslogtreecommitdiffstats
path: root/fs/no-block.c
diff options
context:
space:
mode:
authorAndrea Parri (Microsoft) <parri.andrea@gmail.com>2022-04-19 14:23:25 +0200
committerWei Liu <wei.liu@kernel.org>2022-04-25 15:51:13 +0000
commita765ed47e45166451680ee9af2b9e435c82ec3ba (patch)
treeb94a72b2a71bf59648595591c8b56887d2ae05c9 /fs/no-block.c
parentb91eaf7267cf7aec0a4e087decf7770dfb694d78 (diff)
downloadlinux-stable-a765ed47e45166451680ee9af2b9e435c82ec3ba.tar.gz
linux-stable-a765ed47e45166451680ee9af2b9e435c82ec3ba.tar.bz2
linux-stable-a765ed47e45166451680ee9af2b9e435c82ec3ba.zip
PCI: hv: Fix synchronization between channel callback and hv_compose_msi_msg()
Dexuan wrote: "[...] when we disable AccelNet, the host PCI VSP driver sends a PCI_EJECT message first, and the channel callback may set hpdev->state to hv_pcichild_ejecting on a different CPU. This can cause hv_compose_msi_msg() to exit from the loop and 'return', and the on-stack variable 'ctxt' is invalid. Now, if the response message from the host arrives, the channel callback will try to access the invalid 'ctxt' variable, and this may cause a crash." Schematically: Hyper-V sends PCI_EJECT msg hv_pci_onchannelcallback() state = hv_pcichild_ejecting hv_compose_msi_msg() alloc and init comp_pkt state == hv_pcichild_ejecting Hyper-V sends VM_PKT_COMP msg hv_pci_onchannelcallback() retrieve address of comp_pkt 'free' comp_pkt and return comp_pkt->completion_func() Dexuan also showed how the crash can be triggered after introducing suitable delays in the driver code, thus validating the 'assumption' that the host can still normally respond to the guest's compose_msi request after the host has started to eject the PCI device. Fix the synchronization by leveraging the requestor lock as follows: - Before 'return'-ing in hv_compose_msi_msg(), remove the ID (while holding the requestor lock) associated to the completion packet. - Retrieve the address *and call ->completion_func() within a same (requestor) critical section in hv_pci_onchannelcallback(). Reported-by: Wei Hu <weh@microsoft.com> Reported-by: Dexuan Cui <decui@microsoft.com> Suggested-by: Michael Kelley <mikelley@microsoft.com> Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Reviewed-by: Michael Kelley <mikelley@microsoft.com> Link: https://lore.kernel.org/r/20220419122325.10078-7-parri.andrea@gmail.com Signed-off-by: Wei Liu <wei.liu@kernel.org>
Diffstat (limited to 'fs/no-block.c')
0 files changed, 0 insertions, 0 deletions