Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 498e8bf5 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Alex Williamson
Browse files

sample: vfio-mdev: avoid deadlock in mdev_access() 



mdev_access() calls mbochs_get_page() with mdev_state->ops_lock held,
while mbochs_get_page() locks the mutex by itself.
It leads to unavoidable deadlock.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
parent 1e4b044d

samples/vfio-mdev/mbochs.c

+3 −1
Original line number Diff line number Diff line
@@ -178,6 +178,8 @@ static const char *vbe_name(u32 index) 
	return "(invalid)";

}



static struct page *__mbochs_get_page(struct mdev_state *mdev_state,

				      pgoff_t pgoff);

static struct page *mbochs_get_page(struct mdev_state *mdev_state,

				    pgoff_t pgoff);
@@ -394,7 +396,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count, 
		   MBOCHS_MEMORY_BAR_OFFSET + mdev_state->memsize) {

		pos -= MBOCHS_MMIO_BAR_OFFSET;

		poff = pos & ~PAGE_MASK;

		pg = mbochs_get_page(mdev_state, pos >> PAGE_SHIFT);

		pg = __mbochs_get_page(mdev_state, pos >> PAGE_SHIFT);

		map = kmap(pg);

		if (is_write)

			memcpy(map + poff, buf, count);