Commit 77be00f1 authored by Oleksandr Tyshchenko's avatar Oleksandr Tyshchenko Committed by Juergen Gross
Browse files

xen/virtio: Fix potential deadlock when accessing xen_grant_dma_devices 



As find_xen_grant_dma_data() is called from both interrupt and process
contexts, the access to xen_grant_dma_devices XArray must be protected
by xa_lock_irqsave to avoid deadlock scenario.
As XArray API doesn't provide xa_store_irqsave helper, call lockless
__xa_store directly and guard it externally.

Also move the storage of the XArray's entry to a separate helper.

Fixes: d6aca350 ("xen/grant-dma-ops: Add option to restrict memory access under Xen")
Signed-off-by: default avatarOleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Reviewed-by: default avatarStefano Stabellini <sstabellini@kernel.org>
Reviewed-by: default avatarJuergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20221005174823.1800761-3-olekstysh@gmail.com


Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
parent e433715b

drivers/xen/grant-dma-ops.c

+19 −5
Original line number Diff line number Diff line
@@ -25,7 +25,7 @@ struct xen_grant_dma_data { 
	bool broken;

};



static DEFINE_XARRAY(xen_grant_dma_devices);

static DEFINE_XARRAY_FLAGS(xen_grant_dma_devices, XA_FLAGS_LOCK_IRQ);



#define XEN_GRANT_DMA_ADDR_OFF	(1ULL << 63)
@@ -42,14 +42,29 @@ static inline grant_ref_t dma_to_grant(dma_addr_t dma) 
static struct xen_grant_dma_data *find_xen_grant_dma_data(struct device *dev)

{

	struct xen_grant_dma_data *data;

	unsigned long flags;



	xa_lock(&xen_grant_dma_devices);

	xa_lock_irqsave(&xen_grant_dma_devices, flags);

	data = xa_load(&xen_grant_dma_devices, (unsigned long)dev);

	xa_unlock(&xen_grant_dma_devices);

	xa_unlock_irqrestore(&xen_grant_dma_devices, flags);



	return data;

}



static int store_xen_grant_dma_data(struct device *dev,

				    struct xen_grant_dma_data *data)

{

	unsigned long flags;

	int ret;



	xa_lock_irqsave(&xen_grant_dma_devices, flags);

	ret = xa_err(__xa_store(&xen_grant_dma_devices, (unsigned long)dev, data,

			GFP_ATOMIC));

	xa_unlock_irqrestore(&xen_grant_dma_devices, flags);



	return ret;

}



/*

 * DMA ops for Xen frontends (e.g. virtio).

 *
@@ -338,8 +353,7 @@ void xen_grant_setup_dma_ops(struct device *dev) 
	 */

	data->backend_domid = iommu_spec.args[0];



	if (xa_err(xa_store(&xen_grant_dma_devices, (unsigned long)dev, data,

			GFP_KERNEL))) {

	if (store_xen_grant_dma_data(dev, data)) {

		dev_err(dev, "Cannot store Xen grant DMA data\n");

		goto err;

	}