netdev - Re: [PATCH] vhost: fix IOTLB locking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 30 Nov 2018 20:56:37 +0800
From:   Jason Wang <jasowang@...hat.com>
To:     Jean-Philippe Brucker <jean-philippe.brucker@....com>,
        mst@...hat.com
Cc:     kvm@...r.kernel.org, virtualization@...ts.linux-foundation.org,
        netdev@...r.kernel.org, xiangxia.m.yue@...il.com,
        davem@...emloft.net
Subject: Re: [PATCH] vhost: fix IOTLB locking


On 2018/11/30 下午7:37, Jean-Philippe Brucker wrote:
> Commit 78139c94dc8c ("net: vhost: lock the vqs one by one") moved the vq
> lock to improve scalability, but introduced a possible deadlock in
> vhost-iotlb. vhost_iotlb_notify_vq() now takes vq->mutex while holding
> the device's IOTLB spinlock. And on the vhost_iotlb_miss() path, the
> spinlock is taken while holding vq->mutex.
>
> As long as we hold dev->mutex to prevent an ioctl from modifying
> vq->poll concurrently, we can safely call vhost_poll_queue() without
> holding vq->mutex. Since vhost_process_iotlb_msg() holds dev->mutex when
> calling vhost_iotlb_notify_vq(), avoid the deadlock by not taking
> vq->mutex.
>
> Fixes: 78139c94dc8c ("net: vhost: lock the vqs one by one")
> Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@....com>
> ---
>   drivers/vhost/vhost.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> index 3a5f81a66d34..1cbb17f898f7 100644
> --- a/drivers/vhost/vhost.c
> +++ b/drivers/vhost/vhost.c
> @@ -944,10 +944,10 @@ static void vhost_iotlb_notify_vq(struct vhost_dev *d,
>   		if (msg->iova <= vq_msg->iova &&
>   		    msg->iova + msg->size - 1 >= vq_msg->iova &&
>   		    vq_msg->type == VHOST_IOTLB_MISS) {
> -			mutex_lock(&node->vq->mutex);
> +			/* Safe to call outside vq->mutex as long as dev->mutex
> +			 * is held.
> +			 */
>   			vhost_poll_queue(&node->vq->poll);
> -			mutex_unlock(&node->vq->mutex);
> -
>   			list_del(&node->node);
>   			kfree(node);
>   		}


Acked-by: Jason Wang <jasowang@...hat.com>

Thanks