* [PATCH] xen/pirq: fix error path cleanup when binding MSIs
@ 2018-02-28 9:19 Roger Pau Monne
0 siblings, 0 replies; 10+ messages in thread
From: Roger Pau Monne @ 2018-02-28 9:19 UTC (permalink / raw)
To: linux-kernel
Cc: Juergen Gross, stable, xen-devel, Boris Ostrovsky, Amit Shah,
Roger Pau Monne
Current cleanup in the error path of xen_bind_pirq_msi_to_irq is
wrong. First of all there's an off-by-one in the cleanup loop, which
can lead to unbinding wrong IRQs.
Secondly IRQs not bound won't be freed, thus leaking IRQ numbers.
Note that there's no need to differentiate between bound and unbound
IRQs when freeing them, __unbind_from_irq will deal with both of them
correctly.
Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups")
Reported-by: Hooman Mirhadi <mirhadih@amazon.com>
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
---
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Amit Shah <aams@amazon.com>
CC: stable@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
---
drivers/xen/events/events_base.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index b241bfa529ce..159faf1269fb 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -763,8 +763,8 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev, struct msi_desc *msidesc,
mutex_unlock(&irq_mapping_update_lock);
return irq;
error_irq:
- for (; i >= 0; i--)
- __unbind_from_irq(irq + i);
+ while (nvec--)
+ __unbind_from_irq(irq + nvec);
mutex_unlock(&irq_mapping_update_lock);
return ret;
}
--
2.16.1
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH] xen/pirq: fix error path cleanup when binding MSIs
2018-02-28 9:19 Roger Pau Monne
` (4 preceding siblings ...)
2018-03-15 17:07 ` Shah, Amit
@ 2018-03-15 17:07 ` Shah, Amit
5 siblings, 0 replies; 10+ messages in thread
From: Shah, Amit @ 2018-03-15 17:07 UTC (permalink / raw)
To: linux-kernel, roger.pau; +Cc: boris.ostrovsky, jgross, stable, xen-devel
On Mi, 2018-02-28 at 09:19 +0000, Roger Pau Monne wrote:
> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is
> wrong. First of all there's an off-by-one in the cleanup loop, which
> can lead to unbinding wrong IRQs.
>
> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers.
>
> Note that there's no need to differentiate between bound and unbound
> IRQs when freeing them, __unbind_from_irq will deal with both of them
> correctly.
>
> Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups")
> Reported-by: Hooman Mirhadi <mirhadih@amazon.com>
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
> ---
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
> Cc: Amit Shah <aams@amazon.com>
> CC: stable@vger.kernel.org
> Cc: xen-devel@lists.xenproject.org
The CC to stable got lost on commit, so this didn't actually make
it to the stable queue. Can you please get it queued?
Thanks,
Amazon Development Center Germany GmbH
Berlin - Dresden - Aachen
main office: Krausenstr. 38, 10117 Berlin
Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
Ust-ID: DE289237879
Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] xen/pirq: fix error path cleanup when binding MSIs
2018-02-28 9:19 Roger Pau Monne
` (3 preceding siblings ...)
2018-02-28 19:22 ` Juergen Gross
@ 2018-03-15 17:07 ` Shah, Amit
2018-03-15 17:07 ` Shah, Amit
5 siblings, 0 replies; 10+ messages in thread
From: Shah, Amit @ 2018-03-15 17:07 UTC (permalink / raw)
To: linux-kernel, roger.pau; +Cc: jgross, xen-devel, boris.ostrovsky, stable
On Mi, 2018-02-28 at 09:19 +0000, Roger Pau Monne wrote:
> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is
> wrong. First of all there's an off-by-one in the cleanup loop, which
> can lead to unbinding wrong IRQs.
>
> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers.
>
> Note that there's no need to differentiate between bound and unbound
> IRQs when freeing them, __unbind_from_irq will deal with both of them
> correctly.
>
> Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups")
> Reported-by: Hooman Mirhadi <mirhadih@amazon.com>
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
> ---
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
> Cc: Amit Shah <aams@amazon.com>
> CC: stable@vger.kernel.org
> Cc: xen-devel@lists.xenproject.org
The CC to stable got lost on commit, so this didn't actually make
it to the stable queue. Can you please get it queued?
Thanks,
Amazon Development Center Germany GmbH
Berlin - Dresden - Aachen
main office: Krausenstr. 38, 10117 Berlin
Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
Ust-ID: DE289237879
Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] xen/pirq: fix error path cleanup when binding MSIs
2018-02-28 9:19 Roger Pau Monne
` (2 preceding siblings ...)
2018-02-28 19:22 ` Juergen Gross
@ 2018-02-28 19:22 ` Juergen Gross
2018-03-15 17:07 ` Shah, Amit
2018-03-15 17:07 ` Shah, Amit
5 siblings, 0 replies; 10+ messages in thread
From: Juergen Gross @ 2018-02-28 19:22 UTC (permalink / raw)
To: Roger Pau Monne, linux-kernel
Cc: Boris Ostrovsky, Amit Shah, stable, xen-devel
On 28/02/18 10:19, Roger Pau Monne wrote:
> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is
> wrong. First of all there's an off-by-one in the cleanup loop, which
> can lead to unbinding wrong IRQs.
>
> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers.
>
> Note that there's no need to differentiate between bound and unbound
> IRQs when freeing them, __unbind_from_irq will deal with both of them
> correctly.
>
> Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups")
> Reported-by: Hooman Mirhadi <mirhadih@amazon.com>
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Committed to xen/tip for-linus-4.16a
Juergen
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] xen/pirq: fix error path cleanup when binding MSIs
2018-02-28 9:19 Roger Pau Monne
2018-02-28 9:22 ` Shah, Amit
2018-02-28 9:22 ` Shah, Amit
@ 2018-02-28 19:22 ` Juergen Gross
2018-02-28 19:22 ` Juergen Gross
` (2 subsequent siblings)
5 siblings, 0 replies; 10+ messages in thread
From: Juergen Gross @ 2018-02-28 19:22 UTC (permalink / raw)
To: Roger Pau Monne, linux-kernel
Cc: xen-devel, Boris Ostrovsky, Amit Shah, stable
On 28/02/18 10:19, Roger Pau Monne wrote:
> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is
> wrong. First of all there's an off-by-one in the cleanup loop, which
> can lead to unbinding wrong IRQs.
>
> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers.
>
> Note that there's no need to differentiate between bound and unbound
> IRQs when freeing them, __unbind_from_irq will deal with both of them
> correctly.
>
> Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups")
> Reported-by: Hooman Mirhadi <mirhadih@amazon.com>
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Committed to xen/tip for-linus-4.16a
Juergen
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] xen/pirq: fix error path cleanup when binding MSIs
2018-02-28 9:22 ` Shah, Amit
2018-02-28 14:57 ` Boris Ostrovsky
@ 2018-02-28 14:57 ` Boris Ostrovsky
1 sibling, 0 replies; 10+ messages in thread
From: Boris Ostrovsky @ 2018-02-28 14:57 UTC (permalink / raw)
To: Shah, Amit, linux-kernel, roger.pau; +Cc: jgross, stable, xen-devel
On 02/28/2018 04:22 AM, Shah, Amit wrote:
> On Mi, 2018-02-28 at 09:19 +0000, Roger Pau Monne wrote:
>> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is
>> wrong. First of all there's an off-by-one in the cleanup loop, which
>> can lead to unbinding wrong IRQs.
>>
>> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers.
>>
>> Note that there's no need to differentiate between bound and unbound
>> IRQs when freeing them, __unbind_from_irq will deal with both of them
>> correctly.
>>
>> Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups")
>> Reported-by: Hooman Mirhadi <mirhadih@amazon.com>
>> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
>> ---
>> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
>> Cc: Juergen Gross <jgross@suse.com>
>> Cc: Amit Shah <aams@amazon.com>
>> CC: stable@vger.kernel.org
>> Cc: xen-devel@lists.xenproject.org
>> ---
>> drivers/xen/events/events_base.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/xen/events/events_base.c
>> b/drivers/xen/events/events_base.c
>> index b241bfa529ce..159faf1269fb 100644
>> --- a/drivers/xen/events/events_base.c
>> +++ b/drivers/xen/events/events_base.c
>> @@ -763,8 +763,8 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev,
>> struct msi_desc *msidesc,
>> mutex_unlock(&irq_mapping_update_lock);
>> return irq;
>> error_irq:
>> - for (; i >= 0; i--)
>> - __unbind_from_irq(irq + i);
>> + while (nvec--)
>> + __unbind_from_irq(irq + nvec);
>> mutex_unlock(&irq_mapping_update_lock);
>> return ret;
>> }
> Reviewed-by: Amit Shah <aams@amazon.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] xen/pirq: fix error path cleanup when binding MSIs
2018-02-28 9:22 ` Shah, Amit
@ 2018-02-28 14:57 ` Boris Ostrovsky
2018-02-28 14:57 ` Boris Ostrovsky
1 sibling, 0 replies; 10+ messages in thread
From: Boris Ostrovsky @ 2018-02-28 14:57 UTC (permalink / raw)
To: Shah, Amit, linux-kernel, roger.pau; +Cc: jgross, xen-devel, stable
On 02/28/2018 04:22 AM, Shah, Amit wrote:
> On Mi, 2018-02-28 at 09:19 +0000, Roger Pau Monne wrote:
>> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is
>> wrong. First of all there's an off-by-one in the cleanup loop, which
>> can lead to unbinding wrong IRQs.
>>
>> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers.
>>
>> Note that there's no need to differentiate between bound and unbound
>> IRQs when freeing them, __unbind_from_irq will deal with both of them
>> correctly.
>>
>> Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups")
>> Reported-by: Hooman Mirhadi <mirhadih@amazon.com>
>> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
>> ---
>> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
>> Cc: Juergen Gross <jgross@suse.com>
>> Cc: Amit Shah <aams@amazon.com>
>> CC: stable@vger.kernel.org
>> Cc: xen-devel@lists.xenproject.org
>> ---
>> drivers/xen/events/events_base.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/xen/events/events_base.c
>> b/drivers/xen/events/events_base.c
>> index b241bfa529ce..159faf1269fb 100644
>> --- a/drivers/xen/events/events_base.c
>> +++ b/drivers/xen/events/events_base.c
>> @@ -763,8 +763,8 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev,
>> struct msi_desc *msidesc,
>> mutex_unlock(&irq_mapping_update_lock);
>> return irq;
>> error_irq:
>> - for (; i >= 0; i--)
>> - __unbind_from_irq(irq + i);
>> + while (nvec--)
>> + __unbind_from_irq(irq + nvec);
>> mutex_unlock(&irq_mapping_update_lock);
>> return ret;
>> }
> Reviewed-by: Amit Shah <aams@amazon.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] xen/pirq: fix error path cleanup when binding MSIs
2018-02-28 9:19 Roger Pau Monne
@ 2018-02-28 9:22 ` Shah, Amit
2018-02-28 14:57 ` Boris Ostrovsky
2018-02-28 14:57 ` Boris Ostrovsky
2018-02-28 9:22 ` Shah, Amit
` (4 subsequent siblings)
5 siblings, 2 replies; 10+ messages in thread
From: Shah, Amit @ 2018-02-28 9:22 UTC (permalink / raw)
To: linux-kernel, roger.pau; +Cc: boris.ostrovsky, jgross, stable, xen-devel
On Mi, 2018-02-28 at 09:19 +0000, Roger Pau Monne wrote:
> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is
> wrong. First of all there's an off-by-one in the cleanup loop, which
> can lead to unbinding wrong IRQs.
>
> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers.
>
> Note that there's no need to differentiate between bound and unbound
> IRQs when freeing them, __unbind_from_irq will deal with both of them
> correctly.
>
> Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups")
> Reported-by: Hooman Mirhadi <mirhadih@amazon.com>
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
> ---
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
> Cc: Amit Shah <aams@amazon.com>
> CC: stable@vger.kernel.org
> Cc: xen-devel@lists.xenproject.org
> ---
> drivers/xen/events/events_base.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/xen/events/events_base.c
> b/drivers/xen/events/events_base.c
> index b241bfa529ce..159faf1269fb 100644
> --- a/drivers/xen/events/events_base.c
> +++ b/drivers/xen/events/events_base.c
> @@ -763,8 +763,8 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev,
> struct msi_desc *msidesc,
> mutex_unlock(&irq_mapping_update_lock);
> return irq;
> error_irq:
> - for (; i >= 0; i--)
> - __unbind_from_irq(irq + i);
> + while (nvec--)
> + __unbind_from_irq(irq + nvec);
> mutex_unlock(&irq_mapping_update_lock);
> return ret;
> }
Reviewed-by: Amit Shah <aams@amazon.com>
Amit
Amazon Development Center Germany GmbH
Berlin - Dresden - Aachen
main office: Krausenstr. 38, 10117 Berlin
Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
Ust-ID: DE289237879
Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH] xen/pirq: fix error path cleanup when binding MSIs
2018-02-28 9:19 Roger Pau Monne
2018-02-28 9:22 ` Shah, Amit
@ 2018-02-28 9:22 ` Shah, Amit
2018-02-28 19:22 ` Juergen Gross
` (3 subsequent siblings)
5 siblings, 0 replies; 10+ messages in thread
From: Shah, Amit @ 2018-02-28 9:22 UTC (permalink / raw)
To: linux-kernel, roger.pau; +Cc: jgross, xen-devel, boris.ostrovsky, stable
On Mi, 2018-02-28 at 09:19 +0000, Roger Pau Monne wrote:
> Current cleanup in the error path of xen_bind_pirq_msi_to_irq is
> wrong. First of all there's an off-by-one in the cleanup loop, which
> can lead to unbinding wrong IRQs.
>
> Secondly IRQs not bound won't be freed, thus leaking IRQ numbers.
>
> Note that there's no need to differentiate between bound and unbound
> IRQs when freeing them, __unbind_from_irq will deal with both of them
> correctly.
>
> Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups")
> Reported-by: Hooman Mirhadi <mirhadih@amazon.com>
> Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
> ---
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> Cc: Juergen Gross <jgross@suse.com>
> Cc: Amit Shah <aams@amazon.com>
> CC: stable@vger.kernel.org
> Cc: xen-devel@lists.xenproject.org
> ---
> drivers/xen/events/events_base.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/xen/events/events_base.c
> b/drivers/xen/events/events_base.c
> index b241bfa529ce..159faf1269fb 100644
> --- a/drivers/xen/events/events_base.c
> +++ b/drivers/xen/events/events_base.c
> @@ -763,8 +763,8 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev,
> struct msi_desc *msidesc,
> mutex_unlock(&irq_mapping_update_lock);
> return irq;
> error_irq:
> - for (; i >= 0; i--)
> - __unbind_from_irq(irq + i);
> + while (nvec--)
> + __unbind_from_irq(irq + nvec);
> mutex_unlock(&irq_mapping_update_lock);
> return ret;
> }
Reviewed-by: Amit Shah <aams@amazon.com>
Amit
Amazon Development Center Germany GmbH
Berlin - Dresden - Aachen
main office: Krausenstr. 38, 10117 Berlin
Geschaeftsfuehrer: Dr. Ralf Herbrich, Christian Schlaeger
Ust-ID: DE289237879
Eingetragen am Amtsgericht Charlottenburg HRB 149173 B
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH] xen/pirq: fix error path cleanup when binding MSIs
@ 2018-02-28 9:19 Roger Pau Monne
2018-02-28 9:22 ` Shah, Amit
` (5 more replies)
0 siblings, 6 replies; 10+ messages in thread
From: Roger Pau Monne @ 2018-02-28 9:19 UTC (permalink / raw)
To: linux-kernel
Cc: Roger Pau Monne, Boris Ostrovsky, Juergen Gross, Amit Shah,
stable, xen-devel
Current cleanup in the error path of xen_bind_pirq_msi_to_irq is
wrong. First of all there's an off-by-one in the cleanup loop, which
can lead to unbinding wrong IRQs.
Secondly IRQs not bound won't be freed, thus leaking IRQ numbers.
Note that there's no need to differentiate between bound and unbound
IRQs when freeing them, __unbind_from_irq will deal with both of them
correctly.
Fixes: 4892c9b4ada9f9 ("xen: add support for MSI message groups")
Reported-by: Hooman Mirhadi <mirhadih@amazon.com>
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
---
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Amit Shah <aams@amazon.com>
CC: stable@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
---
drivers/xen/events/events_base.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index b241bfa529ce..159faf1269fb 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -763,8 +763,8 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev, struct msi_desc *msidesc,
mutex_unlock(&irq_mapping_update_lock);
return irq;
error_irq:
- for (; i >= 0; i--)
- __unbind_from_irq(irq + i);
+ while (nvec--)
+ __unbind_from_irq(irq + nvec);
mutex_unlock(&irq_mapping_update_lock);
return ret;
}
--
2.16.1
^ permalink raw reply related [flat|nested] 10+ messages in thread
end of thread, other threads:[~2018-03-15 17:08 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-02-28 9:19 [PATCH] xen/pirq: fix error path cleanup when binding MSIs Roger Pau Monne
-- strict thread matches above, loose matches on Subject: below --
2018-02-28 9:19 Roger Pau Monne
2018-02-28 9:22 ` Shah, Amit
2018-02-28 14:57 ` Boris Ostrovsky
2018-02-28 14:57 ` Boris Ostrovsky
2018-02-28 9:22 ` Shah, Amit
2018-02-28 19:22 ` Juergen Gross
2018-02-28 19:22 ` Juergen Gross
2018-03-15 17:07 ` Shah, Amit
2018-03-15 17:07 ` Shah, Amit
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.