linux-stable.git/drivers/virtio, branch v4.1.41

virtio_balloon: init 1st buffer in stats vq

2017-05-17T19:07:44+00:00

[ Upstream commit fc8653228c8588a120f6b5dad6983b7b61ff669e ]

When init_vqs runs, virtio_balloon.stats is either uninitialized or
contains stale values. The host updates its state with garbage data
because it has no way of knowing that this is just a marker buffer
used for signaling.

This patch updates the stats before pushing the initial buffer.

Alternative fixes:
* Push an empty buffer in init_vqs. Not easily done with the current
  virtio implementation and violates the spec "Driver MUST supply the
  same subset of statistics in all buffers submitted to the statsq".
* Push a buffer with invalid tags in init_vqs. Violates the same
  spec clause, plus "invalid tag" is not really defined.

Note: the spec says:
	When using the legacy interface, the device SHOULD ignore all values in
	the first buffer in the statsq supplied by the driver after device
	initialization. Note: Historically, drivers supplied an uninitialized
	buffer in the first buffer.

Unfortunately QEMU does not seem to implement the recommendation
even for the legacy interface.

Cc: stable@vger.kernel.org
Signed-off-by: Ladi Prosek 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Sasha Levin

virtio_balloon: fix PFN format for virtio-1

2016-08-20T03:08:40+00:00

[ Upstream commit 87c9403b0d1de4676b0bd273eea68fcf6de68e68 ]

Everything should be LE when using virtio-1, but
the linux balloon driver does not seem to care about that.

Reported-by: Cornelia Huck 
Signed-off-by: Michael S. Tsirkin 
Tested-by: Cornelia Huck 
Reviewed-by: Cornelia Huck 
Signed-off-by: Sasha Levin

virtio_balloon: do not change memory amount visible via /proc/meminfo

2016-08-20T03:08:39+00:00

[ Upstream commit 997e120843e82609c8d99a9d5714e6cf91e14cbe ]

Balloon device is frequently used as a mean of cooperative memory control
in between guest and host to manage memory overcommitment. This is the
typical case for any hosting workload when KVM guest is provided for
end-user.

Though there is a problem in this setup. The end-user and hosting provider
have signed SLA agreement in which some amount of memory is guaranted for
the guest. The good thing is that this memory will be given to the guest
when the guest will really need it (f.e. with OOM in guest and with
VIRTIO_BALLOON_F_DEFLATE_ON_OOM configuration flag set). The bad thing
is that end-user does not know this.

Balloon by default reduce the amount of memory exposed to the end-user
each time when the page is stolen from guest or returned back by using
adjust_managed_page_count and thus /proc/meminfo shows reduced amount
of memory.

Fortunately the solution is simple, we should just avoid to call
adjust_managed_page_count with VIRTIO_BALLOON_F_DEFLATE_ON_OOM set.

Signed-off-by: Denis V. Lunev 
CC: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Sasha Levin

balloon: check the number of available pages in leak balloon

2016-08-20T03:07:58+00:00

[ Upstream commit 37cf99e08c6fb4dcea0f9ad2b13b6daa8c76a711 ]

The balloon has a special mechanism that is subscribed to the oom
notification which leads to deflation for a fixed number of pages.
The number is always fixed even when the balloon is fully deflated.
But leak_balloon did not expect that the pages to deflate will be more
than taken, and raise a "BUG" in balloon_page_dequeue when page list
will be empty.

So, the simplest solution would be to check that the number of releases
pages is less or equal to the number taken pages.

Cc: stable@vger.kernel.org
Signed-off-by: Konstantin Neumoin 
Signed-off-by: Denis V. Lunev 
CC: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Sasha Levin

virtio: virtio 1.0 cs04 spec compliance for reset

2016-04-20T05:08:53+00:00

[ Upstream commit 05dbcb430795b2e1fb1d5c757f8619d3dbed0a1c ]

The spec says: after writing 0 to device_status, the driver MUST wait
for a read of device_status to return 0 before reinitializing the
device.

Cc: stable@vger.kernel.org
Signed-off-by: Michael S. Tsirkin 
Acked-by: Jason Wang 
Signed-off-by: Sasha Levin

virtio_pci: fix use after free on release

2016-02-15T20:45:22+00:00

[ Upstream commit 2989be09a8a9d62a785137586ad941f916e08f83 ]

KASan detected a use-after-free error in virtio-pci remove code. In
virtio_pci_remove(), vp_dev is still used after being freed in
unregister_virtio_device() (in virtio_pci_release_dev() more
precisely).

To fix, keep a reference until cleanup is done.

Fixes: 63bd62a08ca4 ("virtio_pci: defer kfree until release callback")
Reported-by: Jerome Marchand 
Cc: stable@vger.kernel.org
Cc: Sasha Levin 
Signed-off-by: Michael S. Tsirkin 
Tested-by: Jerome Marchand 
Signed-off-by: Sasha Levin

virtio_balloon: fix race by fill and leak

2016-02-03T20:31:09+00:00

[ Upstream commit f68b992bbb474641881932c61c92dcfa6f5b3689 ]

During my compaction-related stuff, I encountered a bug
with ballooning.

With repeated inflating and deflating cycle, guest memory(
ie, cat /proc/meminfo | grep MemTotal) is decreased and
couldn't be recovered.

The reason is balloon_lock doesn't cover release_pages_balloon
so struct virtio_balloon fields could be overwritten by race
of fill_balloon(e,g, vb->*pfns could be critical).

This patch fixes it in my test.

Cc: 
Signed-off-by: Minchan Kim 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Sasha Levin

virtio_ballon: change stub of release_pages_by_pfn

2016-02-03T20:31:09+00:00

[ Upstream commit b4d34037329f46ed818d3b0a6e1e23b9c8721f79 ]

and rename it to release_pages_balloon. The function originally takes
arrays of pfns and now it takes pointer to struct virtio_ballon.
This change is necessary to conditionally call adjust_managed_page_count
in the next patch.

Signed-off-by: Denis V. Lunev 
CC: Michael S. Tsirkin 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Sasha Levin

virtio_pci: Clear stale cpumask when setting irq affinity

2015-06-04T12:47:49+00:00

The cpumask vp_dev->msix_affinity_masks[info->msix_vector] may contain
staled information when vp_set_vq_affinity() gets called, so clear it
before setting the new cpu bit mask.

Cc: stable@vger.kernel.org
Signed-off-by: Jiang Liu 
Signed-off-by: Michael S. Tsirkin

virtio: drop virtio_device_is_legacy_only

2015-04-15T03:11:14+00:00

virtio_device_is_legacy_only is now unused, drop
it from core.

Signed-off-by: Michael S. Tsirkin 
Reviewed-by: Cornelia Huck 
Signed-off-by: Rusty Russell