* [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()
@ 2023-07-14 22:45 Dmitry Torokhov
2023-07-14 22:45 ` [PATCH v3 2/2] kvm/vfio: avoid bouncing the mutex when adding and deleting groups Dmitry Torokhov
` (3 more replies)
0 siblings, 4 replies; 10+ messages in thread
From: Dmitry Torokhov @ 2023-07-14 22:45 UTC (permalink / raw)
To: Paolo Bonzini
Cc: Alex Williamson, Greg KH, Sean Christopherson, Roxana Bradescu,
kvm, linux-kernel
kvm_vfio_group_add() creates kvg instance, links it to kv->group_list,
and calls kvm_vfio_file_set_kvm() with kvg->file as an argument after
dropping kv->lock. If we race group addition and deletion calls, kvg
instance may get freed by the time we get around to calling
kvm_vfio_file_set_kvm().
Previous iterations of the code did not reference kvg->file outside of
the critical section, but used a temporary variable. Still, they had
similar problem of the file reference being owned by kvg structure and
potential for kvm_vfio_group_del() dropping it before
kvm_vfio_group_add() had a chance to complete.
Fix this by moving call to kvm_vfio_file_set_kvm() under the protection
of kv->lock. We already call it while holding the same lock when vfio
group is being deleted, so it should be safe here as well.
Fixes: 2fc1bec15883 ("kvm: set/clear kvm to/from vfio_group when group add/delete")
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
v3: added Alex's reviewed-by
v2: updated commit description with the correct "Fixes" tag (per Alex),
expanded commit description to mention issues with the earlier
implementation of kvm_vfio_group_add().
virt/kvm/vfio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index 9584eb57e0ed..cd46d7ef98d6 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -179,10 +179,10 @@ static int kvm_vfio_group_add(struct kvm_device *dev, unsigned int fd)
list_add_tail(&kvg->node, &kv->group_list);
kvm_arch_start_assignment(dev->kvm);
+ kvm_vfio_file_set_kvm(kvg->file, dev->kvm);
mutex_unlock(&kv->lock);
- kvm_vfio_file_set_kvm(kvg->file, dev->kvm);
kvm_vfio_update_coherency(dev);
return 0;
--
2.41.0.255.g8b1d071c50-goog
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH v3 2/2] kvm/vfio: avoid bouncing the mutex when adding and deleting groups
2023-07-14 22:45 [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() Dmitry Torokhov
@ 2023-07-14 22:45 ` Dmitry Torokhov
2023-07-19 5:32 ` Tian, Kevin
2023-07-19 5:33 ` [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() Tian, Kevin
` (2 subsequent siblings)
3 siblings, 1 reply; 10+ messages in thread
From: Dmitry Torokhov @ 2023-07-14 22:45 UTC (permalink / raw)
To: Paolo Bonzini
Cc: Alex Williamson, Greg KH, Sean Christopherson, Roxana Bradescu,
kvm, linux-kernel
Stop taking kv->lock mutex in kvm_vfio_update_coherency() and instead
call it with this mutex held: the callers of the function usually
already have it taken (and released) before calling
kvm_vfio_update_coherency(). This avoid bouncing the lock up and down.
The exception is kvm_vfio_release() where we do not take the lock, but
it is being executed when the very last reference to kvm_device is being
dropped, so there are no concerns about concurrency.
Suggested-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
v3: initialize "ret" with 0 (per Alex), added Alex's reviewed-by
v2: new patch.
virt/kvm/vfio.c | 26 +++++++++-----------------
1 file changed, 9 insertions(+), 17 deletions(-)
diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index cd46d7ef98d6..dbf2b855cf78 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -122,8 +122,6 @@ static void kvm_vfio_update_coherency(struct kvm_device *dev)
bool noncoherent = false;
struct kvm_vfio_group *kvg;
- mutex_lock(&kv->lock);
-
list_for_each_entry(kvg, &kv->group_list, node) {
if (!kvm_vfio_file_enforced_coherent(kvg->file)) {
noncoherent = true;
@@ -139,8 +137,6 @@ static void kvm_vfio_update_coherency(struct kvm_device *dev)
else
kvm_arch_unregister_noncoherent_dma(dev->kvm);
}
-
- mutex_unlock(&kv->lock);
}
static int kvm_vfio_group_add(struct kvm_device *dev, unsigned int fd)
@@ -148,7 +144,7 @@ static int kvm_vfio_group_add(struct kvm_device *dev, unsigned int fd)
struct kvm_vfio *kv = dev->private;
struct kvm_vfio_group *kvg;
struct file *filp;
- int ret;
+ int ret = 0;
filp = fget(fd);
if (!filp)
@@ -157,7 +153,7 @@ static int kvm_vfio_group_add(struct kvm_device *dev, unsigned int fd)
/* Ensure the FD is a vfio group FD.*/
if (!kvm_vfio_file_is_group(filp)) {
ret = -EINVAL;
- goto err_fput;
+ goto out_fput;
}
mutex_lock(&kv->lock);
@@ -165,30 +161,26 @@ static int kvm_vfio_group_add(struct kvm_device *dev, unsigned int fd)
list_for_each_entry(kvg, &kv->group_list, node) {
if (kvg->file == filp) {
ret = -EEXIST;
- goto err_unlock;
+ goto out_unlock;
}
}
kvg = kzalloc(sizeof(*kvg), GFP_KERNEL_ACCOUNT);
if (!kvg) {
ret = -ENOMEM;
- goto err_unlock;
+ goto out_unlock;
}
- kvg->file = filp;
+ kvg->file = get_file(filp);
list_add_tail(&kvg->node, &kv->group_list);
kvm_arch_start_assignment(dev->kvm);
kvm_vfio_file_set_kvm(kvg->file, dev->kvm);
-
- mutex_unlock(&kv->lock);
-
kvm_vfio_update_coherency(dev);
- return 0;
-err_unlock:
+out_unlock:
mutex_unlock(&kv->lock);
-err_fput:
+out_fput:
fput(filp);
return ret;
}
@@ -224,12 +216,12 @@ static int kvm_vfio_group_del(struct kvm_device *dev, unsigned int fd)
break;
}
+ kvm_vfio_update_coherency(dev);
+
mutex_unlock(&kv->lock);
fdput(f);
- kvm_vfio_update_coherency(dev);
-
return ret;
}
--
2.41.0.255.g8b1d071c50-goog
^ permalink raw reply related [flat|nested] 10+ messages in thread
* RE: [PATCH v3 2/2] kvm/vfio: avoid bouncing the mutex when adding and deleting groups
2023-07-14 22:45 ` [PATCH v3 2/2] kvm/vfio: avoid bouncing the mutex when adding and deleting groups Dmitry Torokhov
@ 2023-07-19 5:32 ` Tian, Kevin
2023-07-19 6:10 ` Dmitry Torokhov
0 siblings, 1 reply; 10+ messages in thread
From: Tian, Kevin @ 2023-07-19 5:32 UTC (permalink / raw)
To: Dmitry Torokhov, Paolo Bonzini
Cc: Alex Williamson, Greg KH, Christopherson,,
Sean, Bradescu, Roxana, kvm, linux-kernel
> From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Sent: Saturday, July 15, 2023 6:46 AM
>
> @@ -165,30 +161,26 @@ static int kvm_vfio_group_add(struct kvm_device
> *dev, unsigned int fd)
> list_for_each_entry(kvg, &kv->group_list, node) {
> if (kvg->file == filp) {
> ret = -EEXIST;
> - goto err_unlock;
> + goto out_unlock;
> }
> }
>
> kvg = kzalloc(sizeof(*kvg), GFP_KERNEL_ACCOUNT);
> if (!kvg) {
> ret = -ENOMEM;
> - goto err_unlock;
> + goto out_unlock;
> }
>
> - kvg->file = filp;
> + kvg->file = get_file(filp);
Why is another reference required here?
^ permalink raw reply [flat|nested] 10+ messages in thread
* RE: [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()
2023-07-14 22:45 [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() Dmitry Torokhov
2023-07-14 22:45 ` [PATCH v3 2/2] kvm/vfio: avoid bouncing the mutex when adding and deleting groups Dmitry Torokhov
@ 2023-07-19 5:33 ` Tian, Kevin
2023-07-26 18:11 ` Alex Williamson
2023-08-03 19:38 ` Alex Williamson
3 siblings, 0 replies; 10+ messages in thread
From: Tian, Kevin @ 2023-07-19 5:33 UTC (permalink / raw)
To: Dmitry Torokhov, Paolo Bonzini
Cc: Alex Williamson, Greg KH, Christopherson,,
Sean, Bradescu, Roxana, kvm, linux-kernel
> From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Sent: Saturday, July 15, 2023 6:46 AM
>
> kvm_vfio_group_add() creates kvg instance, links it to kv->group_list,
> and calls kvm_vfio_file_set_kvm() with kvg->file as an argument after
> dropping kv->lock. If we race group addition and deletion calls, kvg
> instance may get freed by the time we get around to calling
> kvm_vfio_file_set_kvm().
>
> Previous iterations of the code did not reference kvg->file outside of
> the critical section, but used a temporary variable. Still, they had
> similar problem of the file reference being owned by kvg structure and
> potential for kvm_vfio_group_del() dropping it before
> kvm_vfio_group_add() had a chance to complete.
>
> Fix this by moving call to kvm_vfio_file_set_kvm() under the protection
> of kv->lock. We already call it while holding the same lock when vfio
> group is being deleted, so it should be safe here as well.
>
> Fixes: 2fc1bec15883 ("kvm: set/clear kvm to/from vfio_group when group
> add/delete")
> Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v3 2/2] kvm/vfio: avoid bouncing the mutex when adding and deleting groups
2023-07-19 5:32 ` Tian, Kevin
@ 2023-07-19 6:10 ` Dmitry Torokhov
2023-07-20 2:36 ` Tian, Kevin
0 siblings, 1 reply; 10+ messages in thread
From: Dmitry Torokhov @ 2023-07-19 6:10 UTC (permalink / raw)
To: Tian, Kevin
Cc: Paolo Bonzini, Alex Williamson, Greg KH, Christopherson,,
Sean, Bradescu, Roxana, kvm, linux-kernel
On Wed, Jul 19, 2023 at 05:32:27AM +0000, Tian, Kevin wrote:
> > From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > Sent: Saturday, July 15, 2023 6:46 AM
> >
> > @@ -165,30 +161,26 @@ static int kvm_vfio_group_add(struct kvm_device
> > *dev, unsigned int fd)
> > list_for_each_entry(kvg, &kv->group_list, node) {
> > if (kvg->file == filp) {
> > ret = -EEXIST;
> > - goto err_unlock;
> > + goto out_unlock;
> > }
> > }
> >
> > kvg = kzalloc(sizeof(*kvg), GFP_KERNEL_ACCOUNT);
> > if (!kvg) {
> > ret = -ENOMEM;
> > - goto err_unlock;
> > + goto out_unlock;
> > }
> >
> > - kvg->file = filp;
> > + kvg->file = get_file(filp);
>
> Why is another reference required here?
Because the function now has a single exit point and the original
reference is dropped unconditionally on exit. It looks cleaner than
checking for non-zero "ret" and deciding whether the reference should be
dropped or kept.
Thanks.
--
Dmitry
^ permalink raw reply [flat|nested] 10+ messages in thread
* RE: [PATCH v3 2/2] kvm/vfio: avoid bouncing the mutex when adding and deleting groups
2023-07-19 6:10 ` Dmitry Torokhov
@ 2023-07-20 2:36 ` Tian, Kevin
2023-07-20 17:10 ` Dmitry Torokhov
0 siblings, 1 reply; 10+ messages in thread
From: Tian, Kevin @ 2023-07-20 2:36 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Paolo Bonzini, Alex Williamson, Greg KH, Christopherson,,
Sean, Bradescu, Roxana, kvm, linux-kernel
> From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Sent: Wednesday, July 19, 2023 2:11 PM
>
> On Wed, Jul 19, 2023 at 05:32:27AM +0000, Tian, Kevin wrote:
> > > From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > > Sent: Saturday, July 15, 2023 6:46 AM
> > >
> > > @@ -165,30 +161,26 @@ static int kvm_vfio_group_add(struct
> kvm_device
> > > *dev, unsigned int fd)
> > > list_for_each_entry(kvg, &kv->group_list, node) {
> > > if (kvg->file == filp) {
> > > ret = -EEXIST;
> > > - goto err_unlock;
> > > + goto out_unlock;
> > > }
> > > }
> > >
> > > kvg = kzalloc(sizeof(*kvg), GFP_KERNEL_ACCOUNT);
> > > if (!kvg) {
> > > ret = -ENOMEM;
> > > - goto err_unlock;
> > > + goto out_unlock;
> > > }
> > >
> > > - kvg->file = filp;
> > > + kvg->file = get_file(filp);
> >
> > Why is another reference required here?
>
> Because the function now has a single exit point and the original
> reference is dropped unconditionally on exit. It looks cleaner than
> checking for non-zero "ret" and deciding whether the reference should be
> dropped or kept.
>
A comment is appreciated. otherwise,
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v3 2/2] kvm/vfio: avoid bouncing the mutex when adding and deleting groups
2023-07-20 2:36 ` Tian, Kevin
@ 2023-07-20 17:10 ` Dmitry Torokhov
0 siblings, 0 replies; 10+ messages in thread
From: Dmitry Torokhov @ 2023-07-20 17:10 UTC (permalink / raw)
To: Tian, Kevin
Cc: Paolo Bonzini, Alex Williamson, Greg KH, Christopherson,,
Sean, Bradescu, Roxana, kvm, linux-kernel
On Thu, Jul 20, 2023 at 02:36:16AM +0000, Tian, Kevin wrote:
> > From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > Sent: Wednesday, July 19, 2023 2:11 PM
> >
> > On Wed, Jul 19, 2023 at 05:32:27AM +0000, Tian, Kevin wrote:
> > > > From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > > > Sent: Saturday, July 15, 2023 6:46 AM
> > > >
> > > > @@ -165,30 +161,26 @@ static int kvm_vfio_group_add(struct
> > kvm_device
> > > > *dev, unsigned int fd)
> > > > list_for_each_entry(kvg, &kv->group_list, node) {
> > > > if (kvg->file == filp) {
> > > > ret = -EEXIST;
> > > > - goto err_unlock;
> > > > + goto out_unlock;
> > > > }
> > > > }
> > > >
> > > > kvg = kzalloc(sizeof(*kvg), GFP_KERNEL_ACCOUNT);
> > > > if (!kvg) {
> > > > ret = -ENOMEM;
> > > > - goto err_unlock;
> > > > + goto out_unlock;
> > > > }
> > > >
> > > > - kvg->file = filp;
> > > > + kvg->file = get_file(filp);
> > >
> > > Why is another reference required here?
> >
> > Because the function now has a single exit point and the original
> > reference is dropped unconditionally on exit. It looks cleaner than
> > checking for non-zero "ret" and deciding whether the reference should be
> > dropped or kept.
> >
>
> A comment is appreciated. otherwise,
>
> Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Thank you for the review! However I do not think any comment is needed,
if one is looking at the final source and not the patch form, the reason
for taking another reference is plain to see.
Thanks!
--
Dmitry
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()
2023-07-14 22:45 [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() Dmitry Torokhov
2023-07-14 22:45 ` [PATCH v3 2/2] kvm/vfio: avoid bouncing the mutex when adding and deleting groups Dmitry Torokhov
2023-07-19 5:33 ` [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() Tian, Kevin
@ 2023-07-26 18:11 ` Alex Williamson
2023-08-03 19:38 ` Alex Williamson
3 siblings, 0 replies; 10+ messages in thread
From: Alex Williamson @ 2023-07-26 18:11 UTC (permalink / raw)
To: Paolo Bonzini
Cc: Dmitry Torokhov, Greg KH, Sean Christopherson, Roxana Bradescu,
kvm, linux-kernel
Hey Paolo,
I'll pull this through the vfio tree unless you have a particular
interest. Thanks,
Alex
On Fri, 14 Jul 2023 15:45:32 -0700
Dmitry Torokhov <dmitry.torokhov@gmail.com> wrote:
> kvm_vfio_group_add() creates kvg instance, links it to kv->group_list,
> and calls kvm_vfio_file_set_kvm() with kvg->file as an argument after
> dropping kv->lock. If we race group addition and deletion calls, kvg
> instance may get freed by the time we get around to calling
> kvm_vfio_file_set_kvm().
>
> Previous iterations of the code did not reference kvg->file outside of
> the critical section, but used a temporary variable. Still, they had
> similar problem of the file reference being owned by kvg structure and
> potential for kvm_vfio_group_del() dropping it before
> kvm_vfio_group_add() had a chance to complete.
>
> Fix this by moving call to kvm_vfio_file_set_kvm() under the protection
> of kv->lock. We already call it while holding the same lock when vfio
> group is being deleted, so it should be safe here as well.
>
> Fixes: 2fc1bec15883 ("kvm: set/clear kvm to/from vfio_group when group add/delete")
> Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> ---
>
> v3: added Alex's reviewed-by
>
> v2: updated commit description with the correct "Fixes" tag (per Alex),
> expanded commit description to mention issues with the earlier
> implementation of kvm_vfio_group_add().
>
> virt/kvm/vfio.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
> index 9584eb57e0ed..cd46d7ef98d6 100644
> --- a/virt/kvm/vfio.c
> +++ b/virt/kvm/vfio.c
> @@ -179,10 +179,10 @@ static int kvm_vfio_group_add(struct kvm_device *dev, unsigned int fd)
> list_add_tail(&kvg->node, &kv->group_list);
>
> kvm_arch_start_assignment(dev->kvm);
> + kvm_vfio_file_set_kvm(kvg->file, dev->kvm);
>
> mutex_unlock(&kv->lock);
>
> - kvm_vfio_file_set_kvm(kvg->file, dev->kvm);
> kvm_vfio_update_coherency(dev);
>
> return 0;
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()
2023-07-14 22:45 [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() Dmitry Torokhov
` (2 preceding siblings ...)
2023-07-26 18:11 ` Alex Williamson
@ 2023-08-03 19:38 ` Alex Williamson
2023-08-03 22:36 ` Dmitry Torokhov
3 siblings, 1 reply; 10+ messages in thread
From: Alex Williamson @ 2023-08-03 19:38 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Paolo Bonzini, Greg KH, Sean Christopherson, Roxana Bradescu,
kvm, linux-kernel
On Fri, 14 Jul 2023 15:45:32 -0700
Dmitry Torokhov <dmitry.torokhov@gmail.com> wrote:
> kvm_vfio_group_add() creates kvg instance, links it to kv->group_list,
> and calls kvm_vfio_file_set_kvm() with kvg->file as an argument after
> dropping kv->lock. If we race group addition and deletion calls, kvg
> instance may get freed by the time we get around to calling
> kvm_vfio_file_set_kvm().
>
> Previous iterations of the code did not reference kvg->file outside of
> the critical section, but used a temporary variable. Still, they had
> similar problem of the file reference being owned by kvg structure and
> potential for kvm_vfio_group_del() dropping it before
> kvm_vfio_group_add() had a chance to complete.
>
> Fix this by moving call to kvm_vfio_file_set_kvm() under the protection
> of kv->lock. We already call it while holding the same lock when vfio
> group is being deleted, so it should be safe here as well.
>
> Fixes: 2fc1bec15883 ("kvm: set/clear kvm to/from vfio_group when group add/delete")
> Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> ---
Applied series to vfio next branch for v6.6. There's a minor rebase
involved, so please double check the results:
https://github.com/awilliam/linux-vfio/commits/next
Thanks,
Alex
>
> v3: added Alex's reviewed-by
>
> v2: updated commit description with the correct "Fixes" tag (per Alex),
> expanded commit description to mention issues with the earlier
> implementation of kvm_vfio_group_add().
>
> virt/kvm/vfio.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
> index 9584eb57e0ed..cd46d7ef98d6 100644
> --- a/virt/kvm/vfio.c
> +++ b/virt/kvm/vfio.c
> @@ -179,10 +179,10 @@ static int kvm_vfio_group_add(struct kvm_device *dev, unsigned int fd)
> list_add_tail(&kvg->node, &kv->group_list);
>
> kvm_arch_start_assignment(dev->kvm);
> + kvm_vfio_file_set_kvm(kvg->file, dev->kvm);
>
> mutex_unlock(&kv->lock);
>
> - kvm_vfio_file_set_kvm(kvg->file, dev->kvm);
> kvm_vfio_update_coherency(dev);
>
> return 0;
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()
2023-08-03 19:38 ` Alex Williamson
@ 2023-08-03 22:36 ` Dmitry Torokhov
0 siblings, 0 replies; 10+ messages in thread
From: Dmitry Torokhov @ 2023-08-03 22:36 UTC (permalink / raw)
To: Alex Williamson
Cc: Paolo Bonzini, Greg KH, Sean Christopherson, Roxana Bradescu,
kvm, linux-kernel
On Thu, Aug 03, 2023 at 01:38:12PM -0600, Alex Williamson wrote:
> On Fri, 14 Jul 2023 15:45:32 -0700
> Dmitry Torokhov <dmitry.torokhov@gmail.com> wrote:
>
> > kvm_vfio_group_add() creates kvg instance, links it to kv->group_list,
> > and calls kvm_vfio_file_set_kvm() with kvg->file as an argument after
> > dropping kv->lock. If we race group addition and deletion calls, kvg
> > instance may get freed by the time we get around to calling
> > kvm_vfio_file_set_kvm().
> >
> > Previous iterations of the code did not reference kvg->file outside of
> > the critical section, but used a temporary variable. Still, they had
> > similar problem of the file reference being owned by kvg structure and
> > potential for kvm_vfio_group_del() dropping it before
> > kvm_vfio_group_add() had a chance to complete.
> >
> > Fix this by moving call to kvm_vfio_file_set_kvm() under the protection
> > of kv->lock. We already call it while holding the same lock when vfio
> > group is being deleted, so it should be safe here as well.
> >
> > Fixes: 2fc1bec15883 ("kvm: set/clear kvm to/from vfio_group when group add/delete")
> > Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
> > Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> > ---
>
> Applied series to vfio next branch for v6.6. There's a minor rebase
> involved, so please double check the results:
>
> https://github.com/awilliam/linux-vfio/commits/next
Looks good to me, thanks!
--
Dmitry
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2023-08-03 22:36 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-07-14 22:45 [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() Dmitry Torokhov
2023-07-14 22:45 ` [PATCH v3 2/2] kvm/vfio: avoid bouncing the mutex when adding and deleting groups Dmitry Torokhov
2023-07-19 5:32 ` Tian, Kevin
2023-07-19 6:10 ` Dmitry Torokhov
2023-07-20 2:36 ` Tian, Kevin
2023-07-20 17:10 ` Dmitry Torokhov
2023-07-19 5:33 ` [PATCH v3 1/2] kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add() Tian, Kevin
2023-07-26 18:11 ` Alex Williamson
2023-08-03 19:38 ` Alex Williamson
2023-08-03 22:36 ` Dmitry Torokhov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).