All of lore.kernel.org
 help / color / mirror / Atom feed
From: Farhan Ali <alifm@linux.ibm.com>
To: cohuck@redhat.com, farman@linux.ibm.com
Cc: pasic@linux.ibm.com, linux-s390@vger.kernel.org,
	kvm@vger.kernel.org, alifm@linux.ibm.com
Subject: [RFC v1 1/1] vfio-ccw: Don't call cp_free if we are processing a channel program
Date: Thu, 20 Jun 2019 17:07:09 -0400	[thread overview]
Message-ID: <46dc0cbdcb8a414d70b7807fceb1cca6229408d5.1561055076.git.alifm@linux.ibm.com> (raw)
In-Reply-To: <cover.1561055076.git.alifm@linux.ibm.com>

There is a small window where it's possible that an interrupt can
arrive and can call cp_free, while we are still processing a channel
program (i.e allocating memory, pinnging pages, translating
addresses etc). This can lead to allocating and freeing at the same
time and can cause memory corruption.

Let's not call cp_free if we are currently processing a channel program.

Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
---

I have been running my test overnight with this patch and I haven't
seen the stack traces that I mentioned about earlier. I would like
to get some reviews on this and also if this is the right thing to
do?

Thanks
Farhan

 drivers/s390/cio/vfio_ccw_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
index 66a66ac..61ece3f 100644
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -88,7 +88,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)
 		     (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT));
 	if (scsw_is_solicited(&irb->scsw)) {
 		cp_update_scsw(&private->cp, &irb->scsw);
-		if (is_final)
+		if (is_final && private->state != VFIO_CCW_STATE_CP_PROCESSING)
 			cp_free(&private->cp);
 	}
 	mutex_lock(&private->io_mutex);
-- 
2.7.4

WARNING: multiple messages have this Message-ID (diff)
From: Farhan Ali <alifm@linux.ibm.com>
To: cohuck@redhat.com, farman@linux.ibm.com
Cc: pasic@linux.ibm.com, linux-s390@vger.kernel.org,
	kvm@vger.kernel.org, alifm@linux.ibm.com
Subject: [RFC v1 1/1] vfio-ccw: Don't call cp_free if we are processing a channel program
Date: Thu, 20 Jun 2019 15:40:24 -0400	[thread overview]
Message-ID: <46dc0cbdcb8a414d70b7807fceb1cca6229408d5.1561055076.git.alifm@linux.ibm.com> (raw)
In-Reply-To: <cover.1561055076.git.alifm@linux.ibm.com>

There is a small window where it's possible that an interrupt can
arrive and can call cp_free, while we are still processing a channel
program (i.e allocating memory, pinnging pages, translating
addresses etc). This can lead to allocating and freeing at the same
time and can cause memory corruption.

Let's not call cp_free if we are currently processing a channel program.

Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
---

I have been running my test overnight with this patch and I haven't
seen the stack traces that I mentioned about earlier. I would like
to get some reviews on this and also if this is the right thing to
do?

Thanks
Farhan

 drivers/s390/cio/vfio_ccw_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
index 66a66ac..61ece3f 100644
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -88,7 +88,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)
 		     (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT));
 	if (scsw_is_solicited(&irb->scsw)) {
 		cp_update_scsw(&private->cp, &irb->scsw);
-		if (is_final)
+		if (is_final && private->state != VFIO_CCW_STATE_CP_PROCESSING)
 			cp_free(&private->cp);
 	}
 	mutex_lock(&private->io_mutex);
-- 
2.7.4


       reply	other threads:[~2019-06-20 21:17 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <cover.1561055076.git.alifm@linux.ibm.com>
2019-06-20 19:40 ` Farhan Ali [this message]
2019-06-20 21:07   ` [RFC v1 1/1] vfio-ccw: Don't call cp_free if we are processing a channel program Farhan Ali
2019-06-20 20:27   ` Eric Farman
2019-06-21 14:17     ` Farhan Ali
2019-06-21 17:40       ` Eric Farman
2019-06-21 18:34         ` Farhan Ali
2019-06-24  9:42           ` Cornelia Huck
2019-06-24 10:05             ` Cornelia Huck
2019-06-24 11:46               ` Cornelia Huck
2019-06-24 12:07                 ` Cornelia Huck
2019-06-24 14:44                   ` Farhan Ali
2019-06-24 15:09                     ` Cornelia Huck
2019-06-24 15:24                       ` Farhan Ali
2019-06-27  9:14                         ` Cornelia Huck
2019-06-28 13:05                           ` Farhan Ali
2019-06-24 11:31             ` Halil Pasic
2019-06-21 14:00   ` Halil Pasic
2019-06-21 14:26     ` Farhan Ali

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=46dc0cbdcb8a414d70b7807fceb1cca6229408d5.1561055076.git.alifm@linux.ibm.com \
    --to=alifm@linux.ibm.com \
    --cc=cohuck@redhat.com \
    --cc=farman@linux.ibm.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-s390@vger.kernel.org \
    --cc=pasic@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.