lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4opfq7hcowqwmz2hzpfcu3icx3z6ce4vmn6pkaeeqxnclgvjd6@x7lyji2owgae> Date: Tue, 30 May 2023 18:11:58 +0200 From: Stefano Garzarella <sgarzare@...hat.com> To: Mike Christie <michael.christie@...cle.com> Cc: "Michael S. Tsirkin" <mst@...hat.com>, syzbot <syzbot+d0d442c22fa8db45ff0e@...kaller.appspotmail.com>, jasowang@...hat.com, kvm@...r.kernel.org, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, syzkaller-bugs@...glegroups.com, virtualization@...ts.linux-foundation.org, stefanha@...hat.com Subject: Re: [syzbot] [kvm?] [net?] [virt?] general protection fault in vhost_work_queue On Tue, May 30, 2023 at 11:01:11AM -0500, Mike Christie wrote: >On 5/30/23 10:58 AM, Mike Christie wrote: >> On 5/30/23 8:44 AM, Stefano Garzarella wrote: >>> >>> From a first glance, it looks like an issue when we call vhost_work_queue(). >>> @Mike, does that ring any bells since you recently looked at that code? >> >> I see the bug. needed to have set the dev->worker after setting worker->vtsk Yes, I came to the same conclusion (see my email sent at the same time :-). >> like below: >> >> >> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c >> index a92af08e7864..7bd95984a501 100644 >> --- a/drivers/vhost/vhost.c >> +++ b/drivers/vhost/vhost.c >> @@ -564,7 +564,6 @@ static int vhost_worker_create(struct vhost_dev *dev) >> if (!worker) >> return -ENOMEM; >> >> - dev->worker = worker; >> worker->kcov_handle = kcov_common_handle(); >> init_llist_head(&worker->work_list); >> snprintf(name, sizeof(name), "vhost-%d", current->pid); >> @@ -576,6 +575,7 @@ static int vhost_worker_create(struct vhost_dev *dev) >> } >> >> worker->vtsk = vtsk; > >Shoot, oh wait, I think I needed a smp_wmb to always make sure worker->vtask >is set before dev->worker or vhost_work_queue could still end up seeing >dev->worker set before worker->vtsk right? But should we pair smp_wmb() with an smp_rmb() wherever we check dev->worker? Thanks, Stefano
Powered by blists - more mailing lists