linux-kernel - RE: [PATCH] PCI: hv: Add hv_pci_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <PU1P153MB01694FE34AEE56373DC9B86BBF660@PU1P153MB0169.APCP153.PROD.OUTLOOK.COM>
Date:   Wed, 13 Feb 2019 00:17:35 +0000
From:   Dexuan Cui <decui@...rosoft.com>
To:     Lorenzo Pieralisi <lorenzo.pieralisi@....com>
CC:     Bjorn Helgaas <bhelgaas@...gle.com>,
        "linux-pci@...r.kernel.org" <linux-pci@...r.kernel.org>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "driverdev-devel@...uxdriverproject.org" 
        <driverdev-devel@...uxdriverproject.org>,
        KY Srinivasan <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Sasha Levin <Alexander.Levin@...rosoft.com>,
        Michael Kelley <mikelley@...rosoft.com>
Subject: RE: [PATCH] PCI: hv: Add hv_pci_remove_slots() when we unload the
 driver

> From: Lorenzo Pieralisi <lorenzo.pieralisi@....com>
> Sent: Tuesday, February 12, 2019 4:13 AM
>  ...
> This patch fixes three bugs:
> 
> 1) set hpdev->pci_slot to NULL
> 2) move code destroying the slot inside a locked region in
>    hv_eject_device_work()
> 3) Add missing slots removal code in hv_pci_remove()
> 
> We need three patches, not one.
> 
> (1) and (2), I am not entirely sure we want them in stable kernels,
> since they are potential bugs, waiting for your input.
> 
> Lorenzo

(1) is actually unnecessary, as I suppose hpdev should be freed at a later
place in the same function hv_eject_device_work -> put_pcichild() -> kfree(hpdev).
But today I think I found a refcount bug in the hot-remove case and the "kfree(hpdev)"
is never called in the hot-remove case. I'll further dig into this and make some extra
patches.

About (2), it's a race condition that can happen when the device is being hot-removed
and we're unloading the pci-hyperv driver at the same time. This is not a normal usage,
so I agree it doesn't really need to go into the stables.

(3) should go into the stables.

I'll make 3 separate patches, and extra patches for the refcount issue, and possible other
minor issues.

Thanks,
-- Dexuan