From: Farhan Ali <alifm@linux.ibm.com> To: cohuck@redhat.com, farman@linux.ibm.com Cc: pasic@linux.ibm.com, linux-s390@vger.kernel.org, kvm@vger.kernel.org, alifm@linux.ibm.com Subject: [RFC v1 1/1] vfio-ccw: Don't call cp_free if we are processing a channel program Date: Thu, 20 Jun 2019 17:07:09 -0400 [thread overview] Message-ID: <46dc0cbdcb8a414d70b7807fceb1cca6229408d5.1561055076.git.alifm@linux.ibm.com> (raw) In-Reply-To: <cover.1561055076.git.alifm@linux.ibm.com> There is a small window where it's possible that an interrupt can arrive and can call cp_free, while we are still processing a channel program (i.e allocating memory, pinnging pages, translating addresses etc). This can lead to allocating and freeing at the same time and can cause memory corruption. Let's not call cp_free if we are currently processing a channel program. Signed-off-by: Farhan Ali <alifm@linux.ibm.com> --- I have been running my test overnight with this patch and I haven't seen the stack traces that I mentioned about earlier. I would like to get some reviews on this and also if this is the right thing to do? Thanks Farhan drivers/s390/cio/vfio_ccw_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c index 66a66ac..61ece3f 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -88,7 +88,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); if (scsw_is_solicited(&irb->scsw)) { cp_update_scsw(&private->cp, &irb->scsw); - if (is_final) + if (is_final && private->state != VFIO_CCW_STATE_CP_PROCESSING) cp_free(&private->cp); } mutex_lock(&private->io_mutex); -- 2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: Farhan Ali <alifm@linux.ibm.com> To: cohuck@redhat.com, farman@linux.ibm.com Cc: pasic@linux.ibm.com, linux-s390@vger.kernel.org, kvm@vger.kernel.org, alifm@linux.ibm.com Subject: [RFC v1 1/1] vfio-ccw: Don't call cp_free if we are processing a channel program Date: Thu, 20 Jun 2019 15:40:24 -0400 [thread overview] Message-ID: <46dc0cbdcb8a414d70b7807fceb1cca6229408d5.1561055076.git.alifm@linux.ibm.com> (raw) In-Reply-To: <cover.1561055076.git.alifm@linux.ibm.com> There is a small window where it's possible that an interrupt can arrive and can call cp_free, while we are still processing a channel program (i.e allocating memory, pinnging pages, translating addresses etc). This can lead to allocating and freeing at the same time and can cause memory corruption. Let's not call cp_free if we are currently processing a channel program. Signed-off-by: Farhan Ali <alifm@linux.ibm.com> --- I have been running my test overnight with this patch and I haven't seen the stack traces that I mentioned about earlier. I would like to get some reviews on this and also if this is the right thing to do? Thanks Farhan drivers/s390/cio/vfio_ccw_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c index 66a66ac..61ece3f 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -88,7 +88,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); if (scsw_is_solicited(&irb->scsw)) { cp_update_scsw(&private->cp, &irb->scsw); - if (is_final) + if (is_final && private->state != VFIO_CCW_STATE_CP_PROCESSING) cp_free(&private->cp); } mutex_lock(&private->io_mutex); -- 2.7.4
next parent reply other threads:[~2019-06-20 21:17 UTC|newest] Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top [not found] <cover.1561055076.git.alifm@linux.ibm.com> 2019-06-20 19:40 ` Farhan Ali [this message] 2019-06-20 21:07 ` [RFC v1 1/1] vfio-ccw: Don't call cp_free if we are processing a channel program Farhan Ali 2019-06-20 20:27 ` Eric Farman 2019-06-21 14:17 ` Farhan Ali 2019-06-21 17:40 ` Eric Farman 2019-06-21 18:34 ` Farhan Ali 2019-06-24 9:42 ` Cornelia Huck 2019-06-24 10:05 ` Cornelia Huck 2019-06-24 11:46 ` Cornelia Huck 2019-06-24 12:07 ` Cornelia Huck 2019-06-24 14:44 ` Farhan Ali 2019-06-24 15:09 ` Cornelia Huck 2019-06-24 15:24 ` Farhan Ali 2019-06-27 9:14 ` Cornelia Huck 2019-06-28 13:05 ` Farhan Ali 2019-06-24 11:31 ` Halil Pasic 2019-06-21 14:00 ` Halil Pasic 2019-06-21 14:26 ` Farhan Ali
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=46dc0cbdcb8a414d70b7807fceb1cca6229408d5.1561055076.git.alifm@linux.ibm.com \ --to=alifm@linux.ibm.com \ --cc=cohuck@redhat.com \ --cc=farman@linux.ibm.com \ --cc=kvm@vger.kernel.org \ --cc=linux-s390@vger.kernel.org \ --cc=pasic@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.