linux-stable.git/drivers/virtio, branch v3.2.99

virtio_balloon: prevent uninitialized variable use

2017-07-18T17:38:38+00:00

commit f0bb2d50dfcc519f06f901aac88502be6ff1df2c upstream.

The latest gcc-7.0.1 snapshot reports a new warning:

virtio/virtio_balloon.c: In function 'update_balloon_stats':
virtio/virtio_balloon.c:258:26: error: 'events[2]' is used uninitialized in this function [-Werror=uninitialized]
virtio/virtio_balloon.c:260:26: error: 'events[3]' is used uninitialized in this function [-Werror=uninitialized]
virtio/virtio_balloon.c:261:56: error: 'events[18]' is used uninitialized in this function [-Werror=uninitialized]
virtio/virtio_balloon.c:262:56: error: 'events[17]' is used uninitialized in this function [-Werror=uninitialized]

This seems absolutely right, so we should add an extra check to
prevent copying uninitialized stack data into the statistics.
>From all I can tell, this has been broken since the statistics code
was originally added in 2.6.34.

Fixes: 9564e138b1f6 ("virtio: Add memory statistics reporting to the balloon driver (V4)")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Ladi Prosek 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Ben Hutchings

virtio_balloon: init 1st buffer in stats vq

2017-07-18T17:38:37+00:00

commit fc8653228c8588a120f6b5dad6983b7b61ff669e upstream.

When init_vqs runs, virtio_balloon.stats is either uninitialized or
contains stale values. The host updates its state with garbage data
because it has no way of knowing that this is just a marker buffer
used for signaling.

This patch updates the stats before pushing the initial buffer.

Alternative fixes:
* Push an empty buffer in init_vqs. Not easily done with the current
  virtio implementation and violates the spec "Driver MUST supply the
  same subset of statistics in all buffers submitted to the statsq".
* Push a buffer with invalid tags in init_vqs. Violates the same
  spec clause, plus "invalid tag" is not really defined.

Note: the spec says:
	When using the legacy interface, the device SHOULD ignore all values in
	the first buffer in the statsq supplied by the driver after device
	initialization. Note: Historically, drivers supplied an uninitialized
	buffer in the first buffer.

Unfortunately QEMU does not seem to implement the recommendation
even for the legacy interface.

Signed-off-by: Ladi Prosek 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Ben Hutchings

balloon: check the number of available pages in leak balloon

2016-11-20T01:01:30+00:00

commit 37cf99e08c6fb4dcea0f9ad2b13b6daa8c76a711 upstream.

The balloon has a special mechanism that is subscribed to the oom
notification which leads to deflation for a fixed number of pages.
The number is always fixed even when the balloon is fully deflated.
But leak_balloon did not expect that the pages to deflate will be more
than taken, and raise a "BUG" in balloon_page_dequeue when page list
will be empty.

So, the simplest solution would be to check that the number of releases
pages is less or equal to the number taken pages.

Signed-off-by: Konstantin Neumoin 
Signed-off-by: Denis V. Lunev 
CC: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

virtio_pci: fix use after free on release

2016-02-27T14:28:44+00:00

commit 2989be09a8a9d62a785137586ad941f916e08f83 upstream.

KASan detected a use-after-free error in virtio-pci remove code. In
virtio_pci_remove(), vp_dev is still used after being freed in
unregister_virtio_device() (in virtio_pci_release_dev() more
precisely).

To fix, keep a reference until cleanup is done.

Fixes: 63bd62a08ca4 ("virtio_pci: defer kfree until release callback")
Reported-by: Jerome Marchand 
Cc: Sasha Levin 
Signed-off-by: Michael S. Tsirkin 
Tested-by: Jerome Marchand 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

virtio_pci: document why we defer kfree

2015-02-20T00:49:34+00:00

commit a1eb03f546d651a8f39c7d0692b1f7f5b4e7e3cd upstream.

The reason we defer kfree until release function is because it's a
general rule for kobjects: kfree of the reference counter itself is only
legal in the release function.

Previous patch didn't make this clear, document this in code.

Signed-off-by: Michael S. Tsirkin 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

virtio_pci: defer kfree until release callback

2015-02-20T00:49:34+00:00

commit 63bd62a08ca45a0c804c3c89777edc7f76a2d6da upstream.

A struct device which has just been unregistered can live on past the
point at which a driver decides to drop it's initial reference to the
kobject gained on allocation.

This implies that when releasing a virtio device, we can't free a struct
virtio_device until the underlying struct device has been released,
which might not happen immediately on device_unregister().

Unfortunately, this is exactly what virtio pci does:
it has an empty release callback, and frees memory immediately
after unregistering the device.

This causes an easy to reproduce crash if CONFIG_DEBUG_KOBJECT_RELEASE
it enabled.

To fix, free the memory only once we know the device is gone in the release
callback.

Signed-off-by: Sasha Levin 
Signed-off-by: Michael S. Tsirkin 
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings

virtio: use dev_to_virtio wrapper in virtio

2015-02-20T00:49:34+00:00

commit 9bffdca8c64a72ac54c47a552734ab457bc720d4 upstream.

Use dev_to_virtio wrapper in virtio to make code clearly.

Cc: Rusty Russell 
Cc: "Michael S. Tsirkin" 
Signed-off-by: Wanlong Gao 
Signed-off-by: Rusty Russell 
Signed-off-by: Ben Hutchings

virtio_balloon: don't softlockup on huge balloon changes.

2014-04-30T15:23:22+00:00

commit 1f74ef0f2d7d692fcd615621e0e734c3e7771413 upstream.

When adding or removing 100G from a balloon:

    BUG: soft lockup - CPU#0 stuck for 22s! [vballoon:367]

We have a wait_event_interruptible(), but the condition is always true
(more ballooning to do) so we don't ever sleep.  We also have a
wait_event() for the host to ack, but that is also always true as QEMU
is synchronous for balloon operations.

Reported-by: Gopesh Kumar Chaudhary 
Signed-off-by: Rusty Russell 
Signed-off-by: Ben Hutchings

virtio: support unlocked queue poll

2013-08-02T20:14:52+00:00

commit cc229884d3f77ec3b1240e467e0236c3e0647c0c upstream.

This adds a way to check ring empty state after enable_cb outside any
locks. Will be used by virtio_net.

Note: there's room for more optimization: caller is likely to have a
memory barrier already, which means we might be able to get rid of a
barrier here.  Deferring this optimization until we do some
benchmarking.

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller 
[wg: Backported to 3.2]
Signed-off-by: Wolfram Gloger 
Signed-off-by: Ben Hutchings

virtio: force vring descriptors to be allocated from lowmem

2013-01-03T03:32:58+00:00

commit b92b1b89a33c172c075edccf6afb0edc41d851fd upstream.

Virtio devices may attempt to add descriptors to a virtqueue from atomic
context using GFP_ATOMIC allocation. This is problematic because such
allocations can fall outside of the lowmem mapping, causing virt_to_phys
to report bogus physical addresses which are subsequently passed to
userspace via the buffers for the virtual device.

This patch masks out __GFP_HIGH and __GFP_HIGHMEM from the requested
flags when allocating descriptors for a virtqueue. If an atomic
allocation is requested and later fails, we will return -ENOSPC which
will be handled by the driver.

Cc: Sasha Levin 
Signed-off-by: Will Deacon 
Signed-off-by: Rusty Russell 
Signed-off-by: Ben Hutchings