Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 63d55b2a authored by Dexuan Cui's avatar Dexuan Cui Committed by Greg Kroah-Hartman
Browse files

Drivers: hv: vmbus: serialize process_chn_event() and vmbus_close_internal() 



process_chn_event(), running in the tasklet, can race with
vmbus_close_internal() in the case of SMP guest, e.g., when the former is
accessing channel->inbound.ring_buffer, the latter could be freeing the
ring_buffer pages.

To resolve the race, we can serialize them by disabling the tasklet when
the latter is running here.

Signed-off-by: default avatarDexuan Cui <decui@microsoft.com>
Signed-off-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent efc26722

drivers/hv/channel.c

+19 −2
Original line number Original line Diff line number Diff line
@@ -28,6 +28,7 @@ 
#include <linux/module.h>

#include <linux/module.h>

#include <linux/hyperv.h>

#include <linux/hyperv.h>

#include <linux/uio.h>

#include <linux/uio.h>

#include <linux/interrupt.h>





#include "hyperv_vmbus.h"

#include "hyperv_vmbus.h"
@@ -496,8 +497,21 @@ static void reset_channel_cb(void *arg) 
static int vmbus_close_internal(struct vmbus_channel *channel)

static int vmbus_close_internal(struct vmbus_channel *channel)

{

{

	struct vmbus_channel_close_channel *msg;

	struct vmbus_channel_close_channel *msg;

	struct tasklet_struct *tasklet;

	int ret;

	int ret;





	/*

	 * process_chn_event(), running in the tasklet, can race

	 * with vmbus_close_internal() in the case of SMP guest, e.g., when

	 * the former is accessing channel->inbound.ring_buffer, the latter

	 * could be freeing the ring_buffer pages.

	 *

	 * To resolve the race, we can serialize them by disabling the

	 * tasklet when the latter is running here.

	 */

	tasklet = hv_context.event_dpc[channel->target_cpu];

	tasklet_disable(tasklet);



	channel->state = CHANNEL_OPEN_STATE;

	channel->state = CHANNEL_OPEN_STATE;

	channel->sc_creation_callback = NULL;

	channel->sc_creation_callback = NULL;

	/* Stop callback and cancel the timer asap */

	/* Stop callback and cancel the timer asap */
@@ -525,7 +539,7 @@ static int vmbus_close_internal(struct vmbus_channel *channel) 
		 * If we failed to post the close msg,

		 * If we failed to post the close msg,

		 * it is perhaps better to leak memory.

		 * it is perhaps better to leak memory.

		 */

		 */

		return ret;

		goto out;

	}

	}





	/* Tear down the gpadl for the channel's ring buffer */

	/* Tear down the gpadl for the channel's ring buffer */
@@ -538,7 +552,7 @@ static int vmbus_close_internal(struct vmbus_channel *channel) 
			 * If we failed to teardown gpadl,

			 * If we failed to teardown gpadl,

			 * it is perhaps better to leak memory.

			 * it is perhaps better to leak memory.

			 */

			 */

			return ret;

			goto out;

		}

		}

	}

	}
@@ -555,6 +569,9 @@ static int vmbus_close_internal(struct vmbus_channel *channel) 
	if (channel->rescind)

	if (channel->rescind)

		hv_process_channel_removal(channel,

		hv_process_channel_removal(channel,

					   channel->offermsg.child_relid);

					   channel->offermsg.child_relid);

out:

	tasklet_enable(tasklet);



	return ret;

	return ret;

}

}