From: Stefano Garzarella <sgarzare@redhat.com>
To: netdev@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>,
kvm@vger.kernel.org, "Michael S. Tsirkin" <mst@redhat.com>,
linux-kernel@vger.kernel.org, Jason Wang <jasowang@redhat.com>,
virtualization@lists.linux-foundation.org,
Stefan Hajnoczi <stefanha@redhat.com>
Subject: [PATCH v3 0/3] vsock/virtio: several fixes in the .probe() and .remove()
Date: Fri, 5 Jul 2019 13:04:51 +0200 [thread overview]
Message-ID: <20190705110454.95302-1-sgarzare@redhat.com> (raw)
During the review of "[PATCH] vsock/virtio: Initialize core virtio vsock
before registering the driver", Stefan pointed out some possible issues
in the .probe() and .remove() callbacks of the virtio-vsock driver.
This series tries to solve these issues:
- Patch 1 adds RCU critical sections to avoid use-after-free of
'the_virtio_vsock' pointer.
- Patch 2 stops workers before to call vdev->config->reset(vdev) to
be sure that no one is accessing the device.
- Patch 3 moves the works flush at the end of the .remove() to avoid
use-after-free of 'vsock' object.
v3:
- Patch 1: use rcu_dereference_protected() to get the_virtio_vosck value in
the virtio_vsock_probe() [Jason]
v2: https://patchwork.kernel.org/cover/11022343/
v1: https://patchwork.kernel.org/cover/10964733/
Before this series the guest crashes in a few second. After this series the
test runs (~12h) without issues.
Tested on an SMP guest (-smp 4 -monitor tcp:127.0.0.1:1234,server,nowait)
with these scripts to stress the .probe()/.remove() path:
- guest
while true; do
cat /dev/urandom | nc-vsock -l 4321 > /dev/null &
cat /dev/urandom | nc-vsock -l 5321 > /dev/null &
cat /dev/urandom | nc-vsock -l 6321 > /dev/null &
cat /dev/urandom | nc-vsock -l 7321 > /dev/null &
wait
done
- host
while true; do
cat /dev/urandom | nc-vsock 3 4321 > /dev/null &
cat /dev/urandom | nc-vsock 3 5321 > /dev/null &
cat /dev/urandom | nc-vsock 3 6321 > /dev/null &
cat /dev/urandom | nc-vsock 3 7321 > /dev/null &
sleep 2
echo "device_del v1" | nc 127.0.0.1 1234
sleep 1
echo "device_add vhost-vsock-pci,id=v1,guest-cid=3" | nc 127.0.0.1 1234
sleep 1
done
Stefano Garzarella (3):
vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock
vsock/virtio: stop workers during the .remove()
vsock/virtio: fix flush of works during the .remove()
net/vmw_vsock/virtio_transport.c | 134 ++++++++++++++++++++++++-------
1 file changed, 104 insertions(+), 30 deletions(-)
--
2.20.1
next reply other threads:[~2019-07-05 11:05 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-05 11:04 Stefano Garzarella [this message]
2019-07-05 11:04 ` [PATCH v3 1/3] vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock Stefano Garzarella
2019-07-05 11:04 ` Stefano Garzarella
2019-07-05 11:04 ` [PATCH v3 2/3] vsock/virtio: stop workers during the .remove() Stefano Garzarella
2019-07-05 11:04 ` Stefano Garzarella
2019-07-05 11:04 ` [PATCH v3 3/3] vsock/virtio: fix flush of works " Stefano Garzarella
2019-07-05 11:04 ` Stefano Garzarella
2019-07-08 22:35 ` [PATCH v3 0/3] vsock/virtio: several fixes in the .probe() and .remove() David Miller
2019-07-08 22:35 ` David Miller
-- strict thread matches above, loose matches on Subject: below --
2019-07-05 11:04 Stefano Garzarella
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190705110454.95302-1-sgarzare@redhat.com \
--to=sgarzare@redhat.com \
--cc=davem@davemloft.net \
--cc=jasowang@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mst@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=stefanha@redhat.com \
--cc=virtualization@lists.linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.