Commit bfcfc16a authored by Alex Williamson's avatar Alex Williamson Committed by Sasha Levin

vfio: Fix group release deadlock

[ Upstream commit 811642d8 ]

If vfio_iommu_group_notifier() acquires a group reference and that
reference becomes the last reference to the group, then vfio_group_put
introduces a deadlock code path where we're trying to unregister from
the iommu notifier chain from within a callout of that chain.  Use a
work_struct to release this reference asynchronously.
Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
Reviewed-by: default avatarEric Auger <eric.auger@redhat.com>
Tested-by: default avatarEric Auger <eric.auger@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent 6750822a
...@@ -295,6 +295,34 @@ static void vfio_group_put(struct vfio_group *group) ...@@ -295,6 +295,34 @@ static void vfio_group_put(struct vfio_group *group)
kref_put_mutex(&group->kref, vfio_group_release, &vfio.group_lock); kref_put_mutex(&group->kref, vfio_group_release, &vfio.group_lock);
} }
struct vfio_group_put_work {
struct work_struct work;
struct vfio_group *group;
};
static void vfio_group_put_bg(struct work_struct *work)
{
struct vfio_group_put_work *do_work;
do_work = container_of(work, struct vfio_group_put_work, work);
vfio_group_put(do_work->group);
kfree(do_work);
}
static void vfio_group_schedule_put(struct vfio_group *group)
{
struct vfio_group_put_work *do_work;
do_work = kmalloc(sizeof(*do_work), GFP_KERNEL);
if (WARN_ON(!do_work))
return;
INIT_WORK(&do_work->work, vfio_group_put_bg);
do_work->group = group;
schedule_work(&do_work->work);
}
/* Assume group_lock or group reference is held */ /* Assume group_lock or group reference is held */
static void vfio_group_get(struct vfio_group *group) static void vfio_group_get(struct vfio_group *group)
{ {
...@@ -601,7 +629,14 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb, ...@@ -601,7 +629,14 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb,
break; break;
} }
vfio_group_put(group); /*
* If we're the last reference to the group, the group will be
* released, which includes unregistering the iommu group notifier.
* We hold a read-lock on that notifier list, unregistering needs
* a write-lock... deadlock. Release our reference asynchronously
* to avoid that situation.
*/
vfio_group_schedule_put(group);
return NOTIFY_OK; return NOTIFY_OK;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment