linux-stable.git/drivers/char/virtio_console.c, branch linux-3.12.y

virtio-console: avoid DMA from stack

2017-05-09T06:19:26+00:00

commit c4baad50297d84bde1a7ad45e50c73adae4a2192 upstream.

put_chars() stuffs the buffer it gets into an sg, but that buffer may be
on the stack. This breaks with CONFIG_VMAP_STACK=y (for me, it
manifested as printks getting turned into NUL bytes).

Signed-off-by: Omar Sandoval 
Signed-off-by: Michael S. Tsirkin 
Reviewed-by: Amit Shah 
Cc: Ben Hutchings 
Cc: Brad Spengler 
Signed-off-by: Jiri Slaby

virtio: console: Unlock vqs while freeing buffers

2016-11-24T15:23:26+00:00

commit 34563769e438d2881f62cf4d9badc4e589ac0ec0 upstream.

Commit c6017e793b93 ("virtio: console: add locks around buffer removal
in port unplug path") added locking around the freeing of buffers in the
vq. However, when free_buf() is called with can_sleep = true and rproc
is enabled, it calls dma_free_coherent() directly, requiring interrupts
to be enabled. Currently a WARNING is triggered due to the spin locking
around free_buf, with a call stack like this:

WARNING: CPU: 3 PID: 121 at ./include/linux/dma-mapping.h:433
free_buf+0x1a8/0x288
Call Trace:
[<8040c538>] show_stack+0x74/0xc0
[<80757240>] dump_stack+0xd0/0x110
[<80430d98>] __warn+0xfc/0x130
[<80430ee0>] warn_slowpath_null+0x2c/0x3c
[<807e7c6c>] free_buf+0x1a8/0x288
[<807ea590>] remove_port_data+0x50/0xac
[<807ea6a0>] unplug_port+0xb4/0x1bc
[<807ea858>] virtcons_remove+0xb0/0xfc
[<807b6734>] virtio_dev_remove+0x58/0xc0
[<807f918c>] __device_release_driver+0xac/0x134
[<807f924c>] device_release_driver+0x38/0x50
[<807f7edc>] bus_remove_device+0xfc/0x130
[<807f4b74>] device_del+0x17c/0x21c
[<807f4c38>] device_unregister+0x24/0x38
[<807b6b50>] unregister_virtio_device+0x28/0x44

Fix this by restructuring the loops to allow the locks to only be taken
where it is necessary to protect the vqs, and release it while the
buffer is being freed.

Fixes: c6017e793b93 ("virtio: console: add locks around buffer removal in port unplug path")
Signed-off-by: Matt Redfearn 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Jiri Slaby

virtio_console: avoid config access from irq

2015-04-09T11:14:04+00:00

commit eeb8a7e8bb123e84daeef84f5a2eab99ad2839a2 upstream.

when multiport is off, virtio console invokes config access from irq
context, config access is blocking on s390.
Fix this up by scheduling work from config irq - similar to what we do
for multiport configs.

Signed-off-by: Michael S. Tsirkin 
Reviewed-by: Amit Shah 
Signed-off-by: Rusty Russell 
Signed-off-by: Jiri Slaby

virtio_console: init work unconditionally

2015-04-09T11:14:03+00:00

commit 4f6e24ed9de8634d6471ef86b382cba6d4e57ca8 upstream.

when multiport is off, we don't initialize config work,
but we then cancel uninitialized control_work on freeze.

Signed-off-by: Michael S. Tsirkin 
Reviewed-by: Amit Shah 
Signed-off-by: Rusty Russell 
Signed-off-by: Jiri Slaby

virtio: console: prevent use-after-free of port name in port unplug

2013-08-09T03:32:16+00:00

Remove the debugfs path before freeing port->name, to prevent a possible
use-after-free.

Reported-by: Jason Wang 
Signed-off-by: Amit Shah 
Signed-off-by: Rusty Russell

Merge branch 'master' into virtio-next

2013-08-09T03:30:39+00:00

The next commit gets conflicts because it relies on patches which were
cc:stable and thus had to be merged into Linus' tree before the coming
merge window.  So pull in master now.

Signed-off-by: Rusty Russell

virtio: console: cleanup an error message

2013-07-30T06:24:30+00:00

The PTR_ERR(NULL) here is not useful.

Signed-off-by: Dan Carpenter 
Reviewed-by: Amit Shah 
Signed-off-by: Rusty Russell

virtio: console: fix locking around send_sigio_to_port()

2013-07-29T05:20:49+00:00

send_sigio_to_port() checks the value of guest_connected, which we
always modify under the inbuf_lock; make sure invocations of
send_sigio_to_port() have take the inbuf_lock around the call.

Signed-off-by: Amit Shah 
Signed-off-by: Rusty Russell

virtio: console: add locking in port unplug path

2013-07-29T05:20:48+00:00

Port unplug can race with close() in port_fops_release().
port_fops_release() already takes the necessary locks, ensure
unplug_port() does that too.

Signed-off-by: Amit Shah 
Signed-off-by: Rusty Russell

virtio: console: add locks around buffer removal in port unplug path

2013-07-29T05:20:47+00:00

The removal functions act on the vqs, and the vq operations need to be
locked.

Signed-off-by: Amit Shah 
Signed-off-by: Rusty Russell