Commit 9ba5c80b authored by Amit Shah's avatar Amit Shah Committed by Rusty Russell

virtio: console: add locking around c_ovq operations

When multiple ovq operations are being performed (lots of open/close
operations on virtio_console fds), the __send_control_msg() function can
get confused without locking.

A simple recipe to cause badness is:
* create a QEMU VM with two virtio-serial ports
* in the guest, do
  while true;do echo abc >/dev/vport0p1;done
  while true;do echo edf >/dev/vport0p2;done

In one run, this caused a panic in __send_control_msg().  In another, I
got

   virtio_console virtio0: control-o:id 0 is not a head!

This also results repeated messages similar to these on the host:

  qemu-kvm: virtio-serial-bus: Unexpected port id 478762112 for device virtio-serial-bus.0
  qemu-kvm: virtio-serial-bus: Unexpected port id 478762368 for device virtio-serial-bus.0
Reported-by: default avatarFuXiangChun <xfu@redhat.com>
Signed-off-by: default avatarAmit Shah <amit.shah@redhat.com>
Reviewed-by: default avatarWanlong Gao <gaowanlong@cn.fujitsu.com>
Reviewed-by: default avatarAsias He <asias@redhat.com>
Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
Cc: stable@kernel.org
parent 165b1b8b
...@@ -150,6 +150,7 @@ struct ports_device { ...@@ -150,6 +150,7 @@ struct ports_device {
/* To protect the vq operations for the control channel */ /* To protect the vq operations for the control channel */
spinlock_t c_ivq_lock; spinlock_t c_ivq_lock;
spinlock_t c_ovq_lock;
/* The current config space is stored here */ /* The current config space is stored here */
struct virtio_console_config config; struct virtio_console_config config;
...@@ -569,11 +570,14 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id, ...@@ -569,11 +570,14 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
vq = portdev->c_ovq; vq = portdev->c_ovq;
sg_init_one(sg, &cpkt, sizeof(cpkt)); sg_init_one(sg, &cpkt, sizeof(cpkt));
spin_lock(&portdev->c_ovq_lock);
if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt, GFP_ATOMIC) == 0) { if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt, GFP_ATOMIC) == 0) {
virtqueue_kick(vq); virtqueue_kick(vq);
while (!virtqueue_get_buf(vq, &len)) while (!virtqueue_get_buf(vq, &len))
cpu_relax(); cpu_relax();
} }
spin_unlock(&portdev->c_ovq_lock);
return 0; return 0;
} }
...@@ -1997,6 +2001,7 @@ static int virtcons_probe(struct virtio_device *vdev) ...@@ -1997,6 +2001,7 @@ static int virtcons_probe(struct virtio_device *vdev)
unsigned int nr_added_bufs; unsigned int nr_added_bufs;
spin_lock_init(&portdev->c_ivq_lock); spin_lock_init(&portdev->c_ivq_lock);
spin_lock_init(&portdev->c_ovq_lock);
INIT_WORK(&portdev->control_work, &control_work_handler); INIT_WORK(&portdev->control_work, &control_work_handler);
nr_added_bufs = fill_queue(portdev->c_ivq, nr_added_bufs = fill_queue(portdev->c_ivq,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment