Commit 0943aacf authored by Xie Yongji's avatar Xie Yongji Committed by Michael S. Tsirkin
Browse files

vduse: Fix race condition between resetting and irq injecting 



The interrupt might be triggered after a reset since there is
no synchronization between resetting and irq injecting. And it
might break something if the interrupt is delayed until a new
round of device initialization.

Fixes: c8a6153b ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Signed-off-by: default avatarXie Yongji <xieyongji@bytedance.com>
Link: https://lore.kernel.org/r/20210929083050.88-1-xieyongji@bytedance.com


Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent 1394103f

drivers/vdpa/vdpa_user/vduse_dev.c

+25 −12
Original line number Diff line number Diff line
@@ -80,6 +80,7 @@ struct vduse_dev { 
	struct vdpa_callback config_cb;

	struct work_struct inject;

	spinlock_t irq_lock;

	struct rw_semaphore rwsem;

	int minor;

	bool broken;

	bool connected;
@@ -410,6 +411,8 @@ static void vduse_dev_reset(struct vduse_dev *dev) 
	if (domain->bounce_map)

		vduse_domain_reset_bounce_map(domain);



	down_write(&dev->rwsem);



	dev->status = 0;

	dev->driver_features = 0;

	dev->generation++;
@@ -443,6 +446,8 @@ static void vduse_dev_reset(struct vduse_dev *dev) 
		flush_work(&vq->inject);

		flush_work(&vq->kick);

	}



	up_write(&dev->rwsem);

}



static int vduse_vdpa_set_vq_address(struct vdpa_device *vdpa, u16 idx,
@@ -885,6 +890,23 @@ static void vduse_vq_irq_inject(struct work_struct *work) 
	spin_unlock_irq(&vq->irq_lock);

}



static int vduse_dev_queue_irq_work(struct vduse_dev *dev,

				    struct work_struct *irq_work)

{

	int ret = -EINVAL;



	down_read(&dev->rwsem);

	if (!(dev->status & VIRTIO_CONFIG_S_DRIVER_OK))

		goto unlock;



	ret = 0;

	queue_work(vduse_irq_wq, irq_work);

unlock:

	up_read(&dev->rwsem);



	return ret;

}



static long vduse_dev_ioctl(struct file *file, unsigned int cmd,

			    unsigned long arg)

{
@@ -966,12 +988,7 @@ static long vduse_dev_ioctl(struct file *file, unsigned int cmd, 
		break;

	}

	case VDUSE_DEV_INJECT_CONFIG_IRQ:

		ret = -EINVAL;

		if (!(dev->status & VIRTIO_CONFIG_S_DRIVER_OK))

			break;



		ret = 0;

		queue_work(vduse_irq_wq, &dev->inject);

		ret = vduse_dev_queue_irq_work(dev, &dev->inject);

		break;

	case VDUSE_VQ_SETUP: {

		struct vduse_vq_config config;
@@ -1049,10 +1066,6 @@ static long vduse_dev_ioctl(struct file *file, unsigned int cmd, 
	case VDUSE_VQ_INJECT_IRQ: {

		u32 index;



		ret = -EINVAL;

		if (!(dev->status & VIRTIO_CONFIG_S_DRIVER_OK))

			break;



		ret = -EFAULT;

		if (get_user(index, (u32 __user *)argp))

			break;
@@ -1061,9 +1074,8 @@ static long vduse_dev_ioctl(struct file *file, unsigned int cmd, 
		if (index >= dev->vq_num)

			break;



		ret = 0;

		index = array_index_nospec(index, dev->vq_num);

		queue_work(vduse_irq_wq, &dev->vqs[index].inject);

		ret = vduse_dev_queue_irq_work(dev, &dev->vqs[index].inject);

		break;

	}

	default:
@@ -1144,6 +1156,7 @@ static struct vduse_dev *vduse_dev_create(void) 
	INIT_LIST_HEAD(&dev->send_list);

	INIT_LIST_HEAD(&dev->recv_list);

	spin_lock_init(&dev->irq_lock);

	init_rwsem(&dev->rwsem);



	INIT_WORK(&dev->inject, vduse_dev_irq_inject);

	init_waitqueue_head(&dev->waitq);