linux-kernel - RE: [PATCH V2 1/6] x86/Hyper-V: Unload vmbus channel in hv panic callback

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Mar 2020 17:11:58 +0000
From:   Michael Kelley <mikelley@...rosoft.com>
To:     "ltykernel@...il.com" <ltykernel@...il.com>,
        KY Srinivasan <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        Wei Liu <liuwe@...rosoft.com>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bp@...en8.de" <bp@...en8.de>, "hpa@...or.com" <hpa@...or.com>,
        "x86@...nel.org" <x86@...nel.org>
CC:     Tianyu Lan <Tianyu.Lan@...rosoft.com>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        vkuznets <vkuznets@...hat.com>
Subject: RE: [PATCH V2 1/6] x86/Hyper-V: Unload vmbus channel in hv panic
 callback

From: Tianyu Lan <Tianyu.Lan@...rosoft.com> Sent: Monday, March 23, 2020 6:09 AM
> 
> When kdump is not configured, a Hyper-V VM might still respond to
> network traffic after a kernel panic when kernel parameter panic=0.
> The panic CPU goes into an infinite loop with interrupts enabled,
> and the VMbus driver interrupt handler still works because the
> VMbus connection is unloaded only in the kdump path.  The network
> responses make the other end of the connection think the VM is
> still functional even though it has panic'ed, which could affect any
> failover actions that should be taken.
> 
> Fix this by unloading the VMbus connection during the panic process.
> vmbus_initiate_unload() could then be called twice (e.g., by
> hyperv_panic_event() and hv_crash_handler(), so reset the connection
> state in vmbus_initiate_unload() to ensure the unload is done only
> once.
> 
> Signed-off-by: Tianyu Lan <Tianyu.Lan@...rosoft.com>
> ---
> Change since v1:
> 	- Update chnage log
> 	- Use xchg() to change vmbus connection status
> ---
>  drivers/hv/channel_mgmt.c |  3 +++
>  drivers/hv/vmbus_drv.c    | 17 +++++++++--------
>  2 files changed, 12 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
> index 0370364169c4..501c43c5851d 100644
> --- a/drivers/hv/channel_mgmt.c
> +++ b/drivers/hv/channel_mgmt.c
> @@ -839,6 +839,9 @@ void vmbus_initiate_unload(bool crash)
>  {
>  	struct vmbus_channel_message_header hdr;
> 
> +	if (xchg(&vmbus_connection.conn_state, DISCONNECTED) == DISCONNECTED)
> +		return;
> +
>  	/* Pre-Win2012R2 hosts don't support reconnect */
>  	if (vmbus_proto_version < VERSION_WIN8_1)
>  		return;
> diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
> index 029378c27421..b56b9fb9bd90 100644
> --- a/drivers/hv/vmbus_drv.c
> +++ b/drivers/hv/vmbus_drv.c
> @@ -53,9 +53,12 @@ static int hyperv_panic_event(struct notifier_block *nb, unsigned
> long val,
>  {
>  	struct pt_regs *regs;
> 
> -	regs = current_pt_regs();
> +	vmbus_initiate_unload(true);
> 
> -	hyperv_report_panic(regs, val);
> +	if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE) {
> +		regs = current_pt_regs();
> +		hyperv_report_panic(regs, val);
> +	}
>  	return NOTIFY_DONE;
>  }
> 
> @@ -1391,10 +1394,12 @@ static int vmbus_bus_init(void)
>  		}
> 
>  		register_die_notifier(&hyperv_die_block);
> -		atomic_notifier_chain_register(&panic_notifier_list,
> -					       &hyperv_panic_block);
>  	}
> 
> +	/* Vmbus channel is unloaded in panic callback when panic happens.*/

Let me suggest a tweak to the above comment so it is super clear:

	/*
	 * Always register the panic notifier because we need to unload
	 * the VMbus channel connection to prevent any VMbus
	 * activity after the VM panics.
	 */

> +	atomic_notifier_chain_register(&panic_notifier_list,
> +			       &hyperv_panic_block);
> +
>  	vmbus_request_offers();
> 
>  	return 0;