From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Qian Cai <cai@lca.pw>,
Alex Williamson <alex.williamson@redhat.com>,
Zeng Tao <prime.zeng@hisilicon.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.4 72/85] vfio/pci: fix racy on error and request eventfd ctx
Date: Tue, 29 Sep 2020 13:00:39 +0200 [thread overview]
Message-ID: <20200929105931.814425033@linuxfoundation.org> (raw)
In-Reply-To: <20200929105928.198942536@linuxfoundation.org>
From: Zeng Tao <prime.zeng@hisilicon.com>
[ Upstream commit b872d0640840018669032b20b6375a478ed1f923 ]
The vfio_pci_release call will free and clear the error and request
eventfd ctx while these ctx could be in use at the same time in the
function like vfio_pci_request, and it's expected to protect them under
the vdev->igate mutex, which is missing in vfio_pci_release.
This issue is introduced since commit 1518ac272e78 ("vfio/pci: fix memory
leaks of eventfd ctx"),and since commit 5c5866c593bb ("vfio/pci: Clear
error and request eventfd ctx after releasing"), it's very easily to
trigger the kernel panic like this:
[ 9513.904346] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
[ 9513.913091] Mem abort info:
[ 9513.915871] ESR = 0x96000006
[ 9513.918912] EC = 0x25: DABT (current EL), IL = 32 bits
[ 9513.924198] SET = 0, FnV = 0
[ 9513.927238] EA = 0, S1PTW = 0
[ 9513.930364] Data abort info:
[ 9513.933231] ISV = 0, ISS = 0x00000006
[ 9513.937048] CM = 0, WnR = 0
[ 9513.940003] user pgtable: 4k pages, 48-bit VAs, pgdp=0000007ec7d12000
[ 9513.946414] [0000000000000008] pgd=0000007ec7d13003, p4d=0000007ec7d13003, pud=0000007ec728c003, pmd=0000000000000000
[ 9513.956975] Internal error: Oops: 96000006 [#1] PREEMPT SMP
[ 9513.962521] Modules linked in: vfio_pci vfio_virqfd vfio_iommu_type1 vfio hclge hns3 hnae3 [last unloaded: vfio_pci]
[ 9513.972998] CPU: 4 PID: 1327 Comm: bash Tainted: G W 5.8.0-rc4+ #3
[ 9513.980443] Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V3.B270.01 05/08/2020
[ 9513.989274] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--)
[ 9513.994827] pc : _raw_spin_lock_irqsave+0x48/0x88
[ 9513.999515] lr : eventfd_signal+0x6c/0x1b0
[ 9514.003591] sp : ffff800038a0b960
[ 9514.006889] x29: ffff800038a0b960 x28: ffff007ef7f4da10
[ 9514.012175] x27: ffff207eefbbfc80 x26: ffffbb7903457000
[ 9514.017462] x25: ffffbb7912191000 x24: ffff007ef7f4d400
[ 9514.022747] x23: ffff20be6e0e4c00 x22: 0000000000000008
[ 9514.028033] x21: 0000000000000000 x20: 0000000000000000
[ 9514.033321] x19: 0000000000000008 x18: 0000000000000000
[ 9514.038606] x17: 0000000000000000 x16: ffffbb7910029328
[ 9514.043893] x15: 0000000000000000 x14: 0000000000000001
[ 9514.049179] x13: 0000000000000000 x12: 0000000000000002
[ 9514.054466] x11: 0000000000000000 x10: 0000000000000a00
[ 9514.059752] x9 : ffff800038a0b840 x8 : ffff007ef7f4de60
[ 9514.065038] x7 : ffff007fffc96690 x6 : fffffe01faffb748
[ 9514.070324] x5 : 0000000000000000 x4 : 0000000000000000
[ 9514.075609] x3 : 0000000000000000 x2 : 0000000000000001
[ 9514.080895] x1 : ffff007ef7f4d400 x0 : 0000000000000000
[ 9514.086181] Call trace:
[ 9514.088618] _raw_spin_lock_irqsave+0x48/0x88
[ 9514.092954] eventfd_signal+0x6c/0x1b0
[ 9514.096691] vfio_pci_request+0x84/0xd0 [vfio_pci]
[ 9514.101464] vfio_del_group_dev+0x150/0x290 [vfio]
[ 9514.106234] vfio_pci_remove+0x30/0x128 [vfio_pci]
[ 9514.111007] pci_device_remove+0x48/0x108
[ 9514.115001] device_release_driver_internal+0x100/0x1b8
[ 9514.120200] device_release_driver+0x28/0x38
[ 9514.124452] pci_stop_bus_device+0x68/0xa8
[ 9514.128528] pci_stop_and_remove_bus_device+0x20/0x38
[ 9514.133557] pci_iov_remove_virtfn+0xb4/0x128
[ 9514.137893] sriov_disable+0x3c/0x108
[ 9514.141538] pci_disable_sriov+0x28/0x38
[ 9514.145445] hns3_pci_sriov_configure+0x48/0xb8 [hns3]
[ 9514.150558] sriov_numvfs_store+0x110/0x198
[ 9514.154724] dev_attr_store+0x44/0x60
[ 9514.158373] sysfs_kf_write+0x5c/0x78
[ 9514.162018] kernfs_fop_write+0x104/0x210
[ 9514.166010] __vfs_write+0x48/0x90
[ 9514.169395] vfs_write+0xbc/0x1c0
[ 9514.172694] ksys_write+0x74/0x100
[ 9514.176079] __arm64_sys_write+0x24/0x30
[ 9514.179987] el0_svc_common.constprop.4+0x110/0x200
[ 9514.184842] do_el0_svc+0x34/0x98
[ 9514.188144] el0_svc+0x14/0x40
[ 9514.191185] el0_sync_handler+0xb0/0x2d0
[ 9514.195088] el0_sync+0x140/0x180
[ 9514.198389] Code: b9001020 d2800000 52800022 f9800271 (885ffe61)
[ 9514.204455] ---[ end trace 648de00c8406465f ]---
[ 9514.212308] note: bash[1327] exited with preempt_count 1
Cc: Qian Cai <cai@lca.pw>
Cc: Alex Williamson <alex.williamson@redhat.com>
Fixes: 1518ac272e78 ("vfio/pci: fix memory leaks of eventfd ctx")
Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/pci/vfio_pci.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 662ea7ec82926..8276ef7f3e834 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -255,14 +255,19 @@ static void vfio_pci_release(void *device_data)
if (!(--vdev->refcnt)) {
vfio_spapr_pci_eeh_release(vdev->pdev);
vfio_pci_disable(vdev);
+ mutex_lock(&vdev->igate);
if (vdev->err_trigger) {
eventfd_ctx_put(vdev->err_trigger);
vdev->err_trigger = NULL;
}
+ mutex_unlock(&vdev->igate);
+
+ mutex_lock(&vdev->igate);
if (vdev->req_trigger) {
eventfd_ctx_put(vdev->req_trigger);
vdev->req_trigger = NULL;
}
+ mutex_unlock(&vdev->igate);
}
mutex_unlock(&driver_lock);
--
2.25.1
next prev parent reply other threads:[~2020-09-29 11:05 UTC|newest]
Thread overview: 93+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-29 10:59 [PATCH 4.4 00/85] 4.4.238-rc1 review Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 01/85] af_key: pfkey_dump needs parameter validation Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 02/85] KVM: fix memory leak in kvm_io_bus_unregister_dev() Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 03/85] kprobes: fix kill kprobe which has been marked as gone Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 04/85] ftrace: Setup correct FTRACE_FL_REGS flags for module Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 05/85] RDMA/ucma: ucma_context reference leak in error path Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 06/85] mtd: Fix comparison in map_word_andequal() Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 07/85] hdlc_ppp: add range checks in ppp_cp_parse_cr() Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 08/85] tipc: use skb_unshare() instead in tipc_buf_append() Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 09/85] net: add __must_check to skb_put_padto() Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 10/85] ip: fix tos reflection in ack and reset packets Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 11/85] serial: 8250: Avoid error message on reprobe Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 12/85] scsi: aacraid: fix illegal IO beyond last LBA Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 13/85] m68k: q40: Fix info-leak in rtc_ioctl Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 14/85] gma/gma500: fix a memory disclosure bug due to uninitialized bytes Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 15/85] ASoC: kirkwood: fix IRQ error handling Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 16/85] PM / devfreq: tegra30: Fix integer overflow on CPUs freq max out Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 17/85] mtd: cfi_cmdset_0002: dont free cfi->cfiq in error path of cfi_amdstd_setup() Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 18/85] mfd: mfd-core: Protect against NULL call-back function pointer Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 19/85] tracing: Adding NULL checks for trace_array descriptor pointer Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 20/85] bcache: fix a lost wake-up problem caused by mca_cannibalize_lock Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 21/85] xfs: fix attr leaf header freemap.size underflow Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 22/85] kernel/sys.c: avoid copying possible padding bytes in copy_to_user Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 23/85] neigh_stat_seq_next() should increase position index Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 24/85] rt_cpu_seq_next " Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 25/85] seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 26/85] ACPI: EC: Reference count query handlers under lock Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 27/85] tracing: Set kernel_stacks caller size properly Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 28/85] ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 29/85] Bluetooth: Fix refcount use-after-free issue Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 30/85] mm: pagewalk: fix termination condition in walk_pte_range() Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 31/85] Bluetooth: prefetch channel before killing sock Greg Kroah-Hartman
2020-09-29 10:59 ` [PATCH 4.4 32/85] skbuff: fix a data race in skb_queue_len() Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 33/85] audit: CONFIG_CHANGE dont log internal bookkeeping as an event Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 34/85] selinux: sel_avc_get_stat_idx should increase position index Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 35/85] scsi: lpfc: Fix RQ buffer leakage when no IOCBs available Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 36/85] drm/omap: fix possible object reference leak Greg Kroah-Hartman
2020-09-29 11:00 ` Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 37/85] dmaengine: tegra-apb: Prevent race conditions on channels freeing Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 38/85] media: go7007: Fix URB type for interrupt handling Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 39/85] Bluetooth: guard against controllers sending zerod events Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 40/85] drm/amdgpu: increase atombios cmd timeout Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 41/85] Bluetooth: L2CAP: handle l2cap config request during open state Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 42/85] media: tda10071: fix unsigned sign extension overflow Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 43/85] tpm: ibmvtpm: Wait for buffer to be set before proceeding Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 44/85] tracing: Use address-of operator on section symbols Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 45/85] serial: 8250_omap: Fix sleeping function called from invalid context during probe Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 46/85] SUNRPC: Fix a potential buffer overflow in svc_print_xprts() Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 47/85] ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 48/85] ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint descriptor Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 49/85] mm/filemap.c: clear page error before actual read Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 50/85] mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 51/85] KVM: Remove CREATE_IRQCHIP/SET_PIT2 race Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 52/85] bdev: Reduce time holding bd_mutex in sync in blkdev_close() Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 53/85] drivers: char: tlclk.c: Avoid data race between init and interrupt handler Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 54/85] dt-bindings: sound: wm8994: Correct required supplies based on actual implementaion Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 55/85] atm: fix a memory leak of vcc->user_back Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 56/85] phy: samsung: s5pv210-usb2: Add delay after reset Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 57/85] Bluetooth: Handle Inquiry Cancel error after Inquiry Complete Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 58/85] USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe() Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 59/85] tty: serial: samsung: Correct clock selection logic Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 60/85] ALSA: hda: Fix potential race in unsol event handler Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 61/85] fuse: dont check refcount after stealing page Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 62/85] USB: EHCI: ehci-mv: fix less than zero comparison of an unsigned int Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 63/85] e1000: Do not perform reset in reset_task if we are already down Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 64/85] printk: handle blank console arguments passed in Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 65/85] vfio/pci: fix memory leaks of eventfd ctx Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 66/85] perf kcore_copy: Fix module map when there are no modules loaded Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 67/85] mtd: rawnand: omap_elm: Fix runtime PM imbalance on error Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 68/85] ceph: fix potential race in ceph_check_caps Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 69/85] mtd: parser: cmdline: Support MTD names containing one or more colons Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 70/85] x86/speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 71/85] vfio/pci: Clear error and request eventfd ctx after releasing Greg Kroah-Hartman
2020-09-29 11:00 ` Greg Kroah-Hartman [this message]
2020-09-29 11:00 ` [PATCH 4.4 73/85] s390/init: add missing __init annotations Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 74/85] mwifiex: Increase AES key storage size to 256 bits Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 75/85] batman-adv: bla: fix type misuse for backbone_gw hash indexing Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 76/85] atm: eni: fix the missed pci_disable_device() for eni_init_one() Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 77/85] batman-adv: mcast/TT: fix wrongly dropped or rerouted packets Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 78/85] ALSA: asihpi: fix iounmap in error handler Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 79/85] MIPS: Add the missing CPU_1074K into __get_cpu_type() Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 80/85] tty: vt, consw->con_scrolldelta cleanup Greg Kroah-Hartman
2020-09-29 11:00 ` Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 81/85] kprobes: Fix to check probe enabled before disarm_kprobe_ftrace() Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 82/85] lib/string.c: implement stpcpy Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 83/85] ata: define AC_ERR_OK Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 84/85] ata: make qc_prep return ata_completion_errors Greg Kroah-Hartman
2020-09-29 11:00 ` [PATCH 4.4 85/85] ata: sata_mv, avoid trigerrable BUG_ON Greg Kroah-Hartman
2020-09-29 12:25 ` [PATCH 4.4 00/85] 4.4.238-rc1 review Pavel Machek
2020-09-29 15:15 ` Jon Hunter
2020-09-29 20:45 ` Guenter Roeck
2020-09-30 19:50 ` Shuah Khan
2020-10-01 1:45 ` Dan Rue
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200929105931.814425033@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=alex.williamson@redhat.com \
--cc=cai@lca.pw \
--cc=linux-kernel@vger.kernel.org \
--cc=prime.zeng@hisilicon.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.