Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 811642d8 authored by Alex Williamson's avatar Alex Williamson
Browse files

vfio: Fix group release deadlock 



If vfio_iommu_group_notifier() acquires a group reference and that
reference becomes the last reference to the group, then vfio_group_put
introduces a deadlock code path where we're trying to unregister from
the iommu notifier chain from within a callout of that chain.  Use a
work_struct to release this reference asynchronously.

Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
Reviewed-by: default avatarEric Auger <eric.auger@redhat.com>
Tested-by: default avatarEric Auger <eric.auger@redhat.com>
Cc: stable@vger.kernel.org
parent 7b3a10df

drivers/vfio/vfio.c

+36 −1
Original line number Diff line number Diff line
@@ -423,6 +423,34 @@ static void vfio_group_put(struct vfio_group *group) 
	kref_put_mutex(&group->kref, vfio_group_release, &vfio.group_lock);

}



struct vfio_group_put_work {

	struct work_struct work;

	struct vfio_group *group;

};



static void vfio_group_put_bg(struct work_struct *work)

{

	struct vfio_group_put_work *do_work;



	do_work = container_of(work, struct vfio_group_put_work, work);



	vfio_group_put(do_work->group);

	kfree(do_work);

}



static void vfio_group_schedule_put(struct vfio_group *group)

{

	struct vfio_group_put_work *do_work;



	do_work = kmalloc(sizeof(*do_work), GFP_KERNEL);

	if (WARN_ON(!do_work))

		return;



	INIT_WORK(&do_work->work, vfio_group_put_bg);

	do_work->group = group;

	schedule_work(&do_work->work);

}



/* Assume group_lock or group reference is held */

static void vfio_group_get(struct vfio_group *group)

{
@@ -762,7 +790,14 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb, 
		break;

	}



	vfio_group_put(group);

	/*

	 * If we're the last reference to the group, the group will be

	 * released, which includes unregistering the iommu group notifier.

	 * We hold a read-lock on that notifier list, unregistering needs

	 * a write-lock... deadlock.  Release our reference asynchronously

	 * to avoid that situation.

	 */

	vfio_group_schedule_put(group);

	return NOTIFY_OK;

}