user/sven/linux.git/drivers/virtio, branch v3.2.78

virtio_pci: fix use after free on release

2016-02-27T14:28:44Z

commit 2989be09a8a9d62a785137586ad941f916e08f83 upstream. KASan detected a use-after-free error in virtio-pci remove code. In virtio_pci_remove(), vp_dev is still used after being freed in unregister_virtio_device() (in virtio_pci_release_dev() more precisely). To fix, keep a reference until cleanup is done. Fixes: 63bd62a08ca4 ("virtio_pci: defer kfree until release callback") Reported-by: Jerome Marchand Cc: Sasha Levin Signed-off-by: Michael S. Tsirkin Tested-by: Jerome Marchand [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings

virtio_pci: document why we defer kfree

2015-02-20T00:49:34Z

commit a1eb03f546d651a8f39c7d0692b1f7f5b4e7e3cd upstream. The reason we defer kfree until release function is because it's a general rule for kobjects: kfree of the reference counter itself is only legal in the release function. Previous patch didn't make this clear, document this in code. Signed-off-by: Michael S. Tsirkin [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings

virtio_pci: defer kfree until release callback

2015-02-20T00:49:34Z

commit 63bd62a08ca45a0c804c3c89777edc7f76a2d6da upstream. A struct device which has just been unregistered can live on past the point at which a driver decides to drop it's initial reference to the kobject gained on allocation. This implies that when releasing a virtio device, we can't free a struct virtio_device until the underlying struct device has been released, which might not happen immediately on device_unregister(). Unfortunately, this is exactly what virtio pci does: it has an empty release callback, and frees memory immediately after unregistering the device. This causes an easy to reproduce crash if CONFIG_DEBUG_KOBJECT_RELEASE it enabled. To fix, free the memory only once we know the device is gone in the release callback. Signed-off-by: Sasha Levin Signed-off-by: Michael S. Tsirkin [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings

virtio: use dev_to_virtio wrapper in virtio

2015-02-20T00:49:34Z

commit 9bffdca8c64a72ac54c47a552734ab457bc720d4 upstream. Use dev_to_virtio wrapper in virtio to make code clearly. Cc: Rusty Russell Cc: "Michael S. Tsirkin" Signed-off-by: Wanlong Gao Signed-off-by: Rusty Russell Signed-off-by: Ben Hutchings

virtio_balloon: don't softlockup on huge balloon changes.

2014-04-30T15:23:22Z

commit 1f74ef0f2d7d692fcd615621e0e734c3e7771413 upstream. When adding or removing 100G from a balloon: BUG: soft lockup - CPU#0 stuck for 22s! [vballoon:367] We have a wait_event_interruptible(), but the condition is always true (more ballooning to do) so we don't ever sleep. We also have a wait_event() for the host to ack, but that is also always true as QEMU is synchronous for balloon operations. Reported-by: Gopesh Kumar Chaudhary Signed-off-by: Rusty Russell Signed-off-by: Ben Hutchings

virtio: support unlocked queue poll

2013-08-02T20:14:52Z

commit cc229884d3f77ec3b1240e467e0236c3e0647c0c upstream. This adds a way to check ring empty state after enable_cb outside any locks. Will be used by virtio_net. Note: there's room for more optimization: caller is likely to have a memory barrier already, which means we might be able to get rid of a barrier here. Deferring this optimization until we do some benchmarking. Signed-off-by: Michael S. Tsirkin Signed-off-by: David S. Miller [wg: Backported to 3.2] Signed-off-by: Wolfram Gloger Signed-off-by: Ben Hutchings

virtio: force vring descriptors to be allocated from lowmem

2013-01-03T03:32:58Z

commit b92b1b89a33c172c075edccf6afb0edc41d851fd upstream. Virtio devices may attempt to add descriptors to a virtqueue from atomic context using GFP_ATOMIC allocation. This is problematic because such allocations can fall outside of the lowmem mapping, causing virt_to_phys to report bogus physical addresses which are subsequently passed to userspace via the buffers for the virtual device. This patch masks out __GFP_HIGH and __GFP_HIGHMEM from the requested flags when allocating descriptors for a virtqueue. If an atomic allocation is requested and later fails, we will return -ENOSPC which will be handled by the driver. Cc: Sasha Levin Signed-off-by: Will Deacon Signed-off-by: Rusty Russell Signed-off-by: Ben Hutchings

virtio-pci: make reset operation safer

2011-11-24T02:34:48Z

virtio pci device reset actually just does an I/O write, which in PCI is really posted, that is it can complete on CPU before the device has received it. Further, interrupts might have been pending on another CPU, so device callback might get invoked after reset. This conflicts with how drivers use reset, which is typically: reset unregister a callback running after reset completed can race with unregister, potentially leading to use after free bugs. Fix by flushing out the write, and flushing pending interrupts. This assumes that device is never reset from its vq/config callbacks, or in parallel with being added/removed, document this assumption. Signed-off-by: Michael S. Tsirkin Signed-off-by: Rusty Russell

virtio-mmio: Correct the name of the guest features selector

2011-11-24T02:34:47Z

Guest features selector spelling mistake. Cc: Pawel Moll Cc: Rusty Russell Cc: virtualization@lists.linux-foundation.org Signed-off-by: Sasha Levin Signed-off-by: Rusty Russell

virtio: add HAS_IOMEM dependency to MMIO platform bus driver

2011-11-24T02:34:47Z

Fix this compile error on s390: CC [M] drivers/virtio/virtio_mmio.o drivers/virtio/virtio_mmio.c: In function 'vm_get_features': drivers/virtio/virtio_mmio.c:107:2: error: implicit declaration of function 'writel' Cc: Christian Borntraeger Signed-off-by: Heiko Carstens Acked-by: Pawel Moll Signed-off-by: Rusty Russell