From: Auger Eric <eric.auger@redhat.com>
To: Jason Gunthorpe <jgg@nvidia.com>, kvm@vger.kernel.org
Cc: Alex Williamson <alex.williamson@redhat.com>,
"Raj, Ashok" <ashok.raj@intel.com>,
Christian Ehrhardt <christian.ehrhardt@canonical.com>,
Cornelia Huck <cohuck@redhat.com>,
Dan Williams <dan.j.williams@intel.com>,
Daniel Vetter <daniel@ffwll.ch>, Christoph Hellwig <hch@lst.de>,
Kevin Tian <kevin.tian@intel.com>,
Leon Romanovsky <leonro@nvidia.com>,
Max Gurtovoy <mgurtovoy@nvidia.com>,
Tarun Gupta <targupta@nvidia.com>
Subject: Re: [PATCH v2 08/14] vfio/pci: Re-order vfio_pci_probe()
Date: Thu, 18 Mar 2021 17:50:26 +0100 [thread overview]
Message-ID: <c68db5c7-873f-595d-19f9-19d6b2bee4a5@redhat.com> (raw)
In-Reply-To: <8-v2-20d933792272+4ff-vfio1_jgg@nvidia.com>
Hi Jason,
On 3/13/21 1:56 AM, Jason Gunthorpe wrote:
> vfio_add_group_dev() must be called only after all of the private data in
> vdev is fully setup and ready, otherwise there could be races with user
> space instantiating a device file descriptor and starting to call ops.
>
> For instance vfio_pci_reflck_attach() sets vdev->reflck and
> vfio_pci_open(), called by fops open, unconditionally derefs it, which
> will crash if things get out of order.>
> Fixes: cc20d7999000 ("vfio/pci: Introduce VF token")
> Fixes: e309df5b0c9e ("vfio/pci: Parallelize device open and release")
> Fixes: 6eb7018705de ("vfio-pci: Move idle devices to D3hot power state")
> Fixes: ecaa1f6a0154 ("vfio-pci: Add VGA arbiter client")
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Thanks
Eric
> ---
> drivers/vfio/pci/vfio_pci.c | 17 +++++++++--------
> 1 file changed, 9 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
> index f95b58376156a0..0e7682e7a0b478 100644
> --- a/drivers/vfio/pci/vfio_pci.c
> +++ b/drivers/vfio/pci/vfio_pci.c
> @@ -2030,13 +2030,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
> INIT_LIST_HEAD(&vdev->vma_list);
> init_rwsem(&vdev->memory_lock);
>
> - ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev);
> - if (ret)
> - goto out_free;
> -
> ret = vfio_pci_reflck_attach(vdev);
> if (ret)
> - goto out_del_group_dev;
> + goto out_free;
> ret = vfio_pci_vf_init(vdev);
> if (ret)
> goto out_reflck;
> @@ -2060,15 +2056,20 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
> vfio_pci_set_power_state(vdev, PCI_D3hot);
> }
>
> - return ret;
> + ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev);
> + if (ret)
> + goto out_power;
> + return 0;
>
> +out_power:
> + if (!disable_idle_d3)
> + vfio_pci_set_power_state(vdev, PCI_D0);
> out_vf:
> vfio_pci_vf_uninit(vdev);
> out_reflck:
> vfio_pci_reflck_put(vdev->reflck);
> -out_del_group_dev:
> - vfio_del_group_dev(&pdev->dev);
> out_free:
> + kfree(vdev->pm_save);
> kfree(vdev);
> out_group_put:
> vfio_iommu_group_put(group, &pdev->dev);
>
next prev parent reply other threads:[~2021-03-18 16:51 UTC|newest]
Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-13 0:55 [PATCH v2 00/14] Embed struct vfio_device in all sub-structures Jason Gunthorpe
2021-03-13 0:55 ` [PATCH v2 01/14] vfio: Remove extra put/gets around vfio_device->group Jason Gunthorpe
2021-03-16 7:33 ` Tian, Kevin
2021-03-16 23:07 ` Jason Gunthorpe
2021-03-17 0:47 ` Tian, Kevin
2021-03-19 13:58 ` Jason Gunthorpe
2021-03-16 11:15 ` Max Gurtovoy
2021-03-16 11:59 ` Cornelia Huck
2021-03-18 9:32 ` Auger Eric
2021-03-13 0:55 ` [PATCH v2 02/14] vfio: Simplify the lifetime logic for vfio_device Jason Gunthorpe
2021-03-16 7:38 ` Tian, Kevin
2021-03-16 12:10 ` Cornelia Huck
2021-03-16 20:24 ` Alex Williamson
2021-03-16 23:08 ` Jason Gunthorpe
2021-03-17 8:12 ` Cornelia Huck
2021-03-23 13:06 ` Jason Gunthorpe
2021-03-18 13:10 ` Auger Eric
2021-03-13 0:55 ` [PATCH v2 03/14] vfio: Split creation of a vfio_device into init and register ops Jason Gunthorpe
2021-03-16 7:55 ` Tian, Kevin
2021-03-16 13:34 ` Jason Gunthorpe
2021-03-17 0:55 ` Tian, Kevin
2021-03-16 12:25 ` Cornelia Huck
2021-03-16 21:13 ` Alex Williamson
2021-03-16 23:12 ` Jason Gunthorpe
2021-03-16 12:54 ` Max Gurtovoy
2021-03-18 13:18 ` Auger Eric
2021-03-13 0:55 ` [PATCH v2 04/14] vfio/platform: Use vfio_init/register/unregister_group_dev Jason Gunthorpe
2021-03-16 16:22 ` Cornelia Huck
2021-03-16 21:33 ` Alex Williamson
2021-03-16 21:45 ` Jason Gunthorpe
2021-03-18 13:40 ` Auger Eric
2021-03-13 0:55 ` [PATCH v2 05/14] vfio/fsl-mc: Re-order vfio_fsl_mc_probe() Jason Gunthorpe
2021-03-15 8:44 ` Christoph Hellwig
2021-03-16 9:16 ` Diana Craciun OSS
2021-03-16 16:28 ` Cornelia Huck
2021-03-17 16:36 ` Diana Craciun OSS
2021-03-17 22:59 ` Jason Gunthorpe
2021-03-13 0:55 ` [PATCH v2 06/14] vfio/fsl-mc: Use vfio_init/register/unregister_group_dev Jason Gunthorpe
2021-03-15 8:44 ` Christoph Hellwig
2021-03-16 16:43 ` Cornelia Huck
2021-03-13 0:55 ` [PATCH v2 07/14] vfio/pci: Move VGA and VF initialization to functions Jason Gunthorpe
2021-03-15 8:45 ` Christoph Hellwig
2021-03-15 23:07 ` Jason Gunthorpe
2021-03-16 6:27 ` Christoph Hellwig
2021-03-16 7:57 ` Tian, Kevin
2021-03-16 13:02 ` Max Gurtovoy
2021-03-16 23:04 ` Jason Gunthorpe
2021-03-16 16:51 ` Cornelia Huck
2021-03-18 16:34 ` Auger Eric
2021-03-13 0:56 ` [PATCH v2 08/14] vfio/pci: Re-order vfio_pci_probe() Jason Gunthorpe
2021-03-15 8:46 ` Christoph Hellwig
2021-03-16 8:04 ` Tian, Kevin
2021-03-16 13:20 ` Jason Gunthorpe
2021-03-16 22:27 ` Alex Williamson
2021-03-17 0:56 ` Tian, Kevin
2021-03-16 11:28 ` Max Gurtovoy
2021-03-17 10:32 ` Cornelia Huck
2021-03-18 16:50 ` Auger Eric [this message]
2021-03-13 0:56 ` [PATCH v2 09/14] vfio/pci: Use vfio_init/register/unregister_group_dev Jason Gunthorpe
2021-03-16 8:06 ` Tian, Kevin
2021-03-17 10:33 ` Cornelia Huck
2021-03-18 13:43 ` Auger Eric
2021-03-13 0:56 ` [PATCH v2 10/14] vfio/mdev: " Jason Gunthorpe
2021-03-16 8:09 ` Tian, Kevin
2021-03-16 22:51 ` Alex Williamson
2021-03-16 23:19 ` Jason Gunthorpe
2021-03-17 10:36 ` Cornelia Huck
2021-03-13 0:56 ` [PATCH v2 11/14] vfio/mdev: Make to_mdev_device() into a static inline Jason Gunthorpe
2021-03-16 8:10 ` Tian, Kevin
2021-03-16 22:55 ` Alex Williamson
2021-03-16 23:20 ` Jason Gunthorpe
2021-03-17 10:36 ` Cornelia Huck
2021-03-13 0:56 ` [PATCH v2 12/14] vfio: Make vfio_device_ops pass a 'struct vfio_device *' instead of 'void *' Jason Gunthorpe
2021-03-15 8:58 ` Christoph Hellwig
2021-03-17 11:33 ` Cornelia Huck
2021-03-13 0:56 ` [PATCH v2 13/14] vfio/pci: Replace uses of vfio_device_data() with container_of Jason Gunthorpe
2021-03-16 8:20 ` Tian, Kevin
2021-03-17 12:06 ` Cornelia Huck
2021-03-13 0:56 ` [PATCH v2 14/14] vfio: Remove device_data from the vfio bus driver API Jason Gunthorpe
2021-03-16 8:22 ` Tian, Kevin
2021-03-17 12:08 ` Cornelia Huck
2021-03-17 23:24 ` Max Gurtovoy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c68db5c7-873f-595d-19f9-19d6b2bee4a5@redhat.com \
--to=eric.auger@redhat.com \
--cc=alex.williamson@redhat.com \
--cc=ashok.raj@intel.com \
--cc=christian.ehrhardt@canonical.com \
--cc=cohuck@redhat.com \
--cc=dan.j.williams@intel.com \
--cc=daniel@ffwll.ch \
--cc=hch@lst.de \
--cc=jgg@nvidia.com \
--cc=kevin.tian@intel.com \
--cc=kvm@vger.kernel.org \
--cc=leonro@nvidia.com \
--cc=mgurtovoy@nvidia.com \
--cc=targupta@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).