diff options
| author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2018-07-06 23:50:06 +0300 |
|---|---|---|
| committer | Alex Williamson <alex.williamson@redhat.com> | 2018-07-11 13:22:41 -0600 |
| commit | 498e8bf51c633cc4496343e6113f340f8e9301ae (patch) | |
| tree | 43bdf27e23afef2d4c07e184372a979c3910ef7d /samples | |
| parent | 1e4b044d22517cae7047c99038abb444423243ca (diff) | |
| download | linux-498e8bf51c633cc4496343e6113f340f8e9301ae.tar.gz linux-498e8bf51c633cc4496343e6113f340f8e9301ae.tar.bz2 linux-498e8bf51c633cc4496343e6113f340f8e9301ae.zip | |
sample: vfio-mdev: avoid deadlock in mdev_access()
mdev_access() calls mbochs_get_page() with mdev_state->ops_lock held,
while mbochs_get_page() locks the mutex by itself.
It leads to unavoidable deadlock.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Diffstat (limited to 'samples')
| -rw-r--r-- | samples/vfio-mdev/mbochs.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-mdev/mbochs.c index d5d5a499160c..2535c3677c7b 100644 --- a/samples/vfio-mdev/mbochs.c +++ b/samples/vfio-mdev/mbochs.c @@ -178,6 +178,8 @@ static const char *vbe_name(u32 index) return "(invalid)"; } +static struct page *__mbochs_get_page(struct mdev_state *mdev_state, + pgoff_t pgoff); static struct page *mbochs_get_page(struct mdev_state *mdev_state, pgoff_t pgoff); @@ -394,7 +396,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, MBOCHS_MEMORY_BAR_OFFSET + mdev_state->memsize) { pos -= MBOCHS_MMIO_BAR_OFFSET; poff = pos & ~PAGE_MASK; - pg = mbochs_get_page(mdev_state, pos >> PAGE_SHIFT); + pg = __mbochs_get_page(mdev_state, pos >> PAGE_SHIFT); map = kmap(pg); if (is_write) memcpy(map + poff, buf, count); |