linux-stable.git/drivers/vhost/vhost.c, branch linux-3.16.y

vhost: make sure log_num < in_num

2019-09-23T20:12:11+00:00

commit 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4 upstream.

The code assumes log_num < in_num everywhere, and that is true as long as
in_num is incremented by descriptor iov count, and log_num by 1. However
this breaks if there's a zero sized descriptor.

As a result, if a malicious guest creates a vring desc with desc.len = 0,
it may cause the host kernel to crash by overflowing the log array. This
bug can be triggered during the VM migration.

There's no need to log when desc.len = 0, so just don't increment log_num
in this case.

Fixes: 3a4d5c94e959 ("vhost_net: a kernel-level virtio server")
Reviewed-by: Lidong Chen 
Signed-off-by: ruippan 
Signed-off-by: yongduan 
Acked-by: Michael S. Tsirkin 
Reviewed-by: Tyler Hicks 
Signed-off-by: Michael S. Tsirkin 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

vhost: introduce vhost_exceeds_weight()

2019-08-13T11:39:24+00:00

commit e82b9b0727ff6d665fff2d326162b460dded554d upstream.

We used to have vhost_exceeds_weight() for vhost-net to:

- prevent vhost kthread from hogging the cpu
- balance the time spent between TX and RX

This function could be useful for vsock and scsi as well. So move it
to vhost.c. Device must specify a weight which counts the number of
requests, or it can also specific a byte_weight which counts the
number of bytes that has been processed.

Signed-off-by: Jason Wang 
Reviewed-by: Stefan Hajnoczi 
Signed-off-by: Michael S. Tsirkin 
[bwh: Backported to 3.16:
 - Drop changes to vhost_vsock
 - In vhost_net, both Tx modes are handled in one loop in handle_tx()
 - Adjust context]
Signed-off-by: Ben Hutchings

vhost: make sure used idx is seen before log in vhost_add_used_n()

2019-02-11T17:54:25+00:00

commit 841df922417eb82c835e93d4b93eb6a68c99d599 upstream.

We miss a write barrier that guarantees used idx is updated and seen
before log. This will let userspace sync and copy used ring before
used idx is update. Fix this by adding a barrier before log_write().

Fixes: 8dd014adfea6f ("vhost-net: mergeable buffers support")
Acked-by: Michael S. Tsirkin 
Signed-off-by: Jason Wang 
Signed-off-by: David S. Miller 
Signed-off-by: Ben Hutchings

drivers/vhost: Fix mmu_context.h assumption

2018-01-09T00:35:08+00:00

Some architectures (such as Alpha) rely on include/linux/sched.h definitions
in their mmu_context.h files.

So include sched.h before mmu_context.h.

(This doesn't seem to be needed upstream, though a similar problem was
fixed by commit 8efd755ac2fe "mm/mmu_context, sched/core: Fix mmu_context.h
assumption".)

Cc: Ingo Molnar 
Cc: Hugh Dickins 
Signed-off-by: Ben Hutchings

vhost: actually track log eventfd file

2015-08-25T09:13:39+00:00

commit 7932c0bd7740f4cd2aa168d3ce0199e7af7d72d5 upstream.

While reviewing vhost log code, I found out that log_file is never
set. Note: I haven't tested the change (QEMU doesn't use LOG_FD yet).

Signed-off-by: Marc-André Lureau 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Luis Henriques

vhost: move memory pointer to VQs

2014-06-09T13:21:07+00:00

commit 2ae76693b8bcabf370b981cd00c36cd41d33fabc
    vhost: replace rcu with mutex
replaced rcu sync for memory accesses with VQ mutex locl/unlock.
This is correct since all accesses are under VQ mutex, but incomplete:
we still do useless rcu lock/unlock operations, someone might copy this
code into some other context where this won't be right.
This use of RCU is also non standard and hard to understand.
Let's copy the pointer to each VQ structure, this way
the access rules become straight-forward, and there's
no need for RCU anymore.

Reported-by: Eric Dumazet 
Signed-off-by: Michael S. Tsirkin

vhost: move acked_features to VQs

2014-06-09T13:21:06+00:00

Refactor code to make sure features are only accessed
under VQ mutex. This makes everything simpler, no need
for RCU here anymore.

Signed-off-by: Michael S. Tsirkin

vhost: replace rcu with mutex

2014-06-09T13:21:06+00:00

All memory accesses are done under some VQ mutex.
So lock/unlock all VQs is a faster equivalent of synchronize_rcu()
for memory access changes.
Some guests cause a lot of these changes, so it's helpful
to make them faster.

Reported-by: "Gonglei (Arei)" 
Signed-off-by: Michael S. Tsirkin

vhost: remove the dead branch

2013-12-06T20:22:05+00:00

Since vhost_dev_init() forever return 0, some branches are never run,
therefore need to be removed.

Signed-off-by: Zhi Yong Wu 
Acked-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller

vhost: wake up worker outside spin_lock

2013-09-17T06:21:32+00:00

the wake_up_process func is included by spin_lock/unlock in
vhost_work_queue,
but it could be done outside the spin_lock.
I have test it with kernel 3.0.27 and guest suse11-sp2 using iperf,
the num as below.
                  original                 modified
thread_num  tp(Gbps)   vhost(%)  |  tp(Gbps)     vhost(%)
1           9.59        28.82    |   9.59        27.49
8           9.61        32.92    |   9.62        26.77
64          9.58        46.48    |   9.55        38.99
256         9.6         63.7     |   9.6         52.59

Signed-off-by: Chuanyu Qin 
Signed-off-by: Michael S. Tsirkin