| From 9ba5c80b1aea8648a3efe5f22dc1f7cacdfbeeb8 Mon Sep 17 00:00:00 2001 |
| From: Amit Shah <amit.shah@redhat.com> |
| Date: Fri, 29 Mar 2013 16:30:08 +0530 |
| Subject: virtio: console: add locking around c_ovq operations |
| |
| From: Amit Shah <amit.shah@redhat.com> |
| |
| commit 9ba5c80b1aea8648a3efe5f22dc1f7cacdfbeeb8 upstream. |
| |
| When multiple ovq operations are being performed (lots of open/close |
| operations on virtio_console fds), the __send_control_msg() function can |
| get confused without locking. |
| |
| A simple recipe to cause badness is: |
| * create a QEMU VM with two virtio-serial ports |
| * in the guest, do |
| while true;do echo abc >/dev/vport0p1;done |
| while true;do echo edf >/dev/vport0p2;done |
| |
| In one run, this caused a panic in __send_control_msg(). In another, I |
| got |
| |
| virtio_console virtio0: control-o:id 0 is not a head! |
| |
| This also results repeated messages similar to these on the host: |
| |
| qemu-kvm: virtio-serial-bus: Unexpected port id 478762112 for device virtio-serial-bus.0 |
| qemu-kvm: virtio-serial-bus: Unexpected port id 478762368 for device virtio-serial-bus.0 |
| |
| Reported-by: FuXiangChun <xfu@redhat.com> |
| Signed-off-by: Amit Shah <amit.shah@redhat.com> |
| Reviewed-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> |
| Reviewed-by: Asias He <asias@redhat.com> |
| Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> |
| [bwh: Backported to 3.2: adjust context] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| [wyj: Backported to 3.4: adjust context] |
| Signed-off-by: Yijing Wang <wangyijing@huawei.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/char/virtio_console.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| --- a/drivers/char/virtio_console.c |
| +++ b/drivers/char/virtio_console.c |
| @@ -132,6 +132,7 @@ struct ports_device { |
| |
| /* To protect the vq operations for the control channel */ |
| spinlock_t c_ivq_lock; |
| + spinlock_t c_ovq_lock; |
| |
| /* The current config space is stored here */ |
| struct virtio_console_config config; |
| @@ -460,11 +461,14 @@ static ssize_t __send_control_msg(struct |
| vq = portdev->c_ovq; |
| |
| sg_init_one(sg, &cpkt, sizeof(cpkt)); |
| + |
| + spin_lock(&portdev->c_ovq_lock); |
| if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt, GFP_ATOMIC) >= 0) { |
| virtqueue_kick(vq); |
| while (!virtqueue_get_buf(vq, &len)) |
| cpu_relax(); |
| } |
| + spin_unlock(&portdev->c_ovq_lock); |
| return 0; |
| } |
| |
| @@ -1752,6 +1756,7 @@ static int __devinit virtcons_probe(stru |
| unsigned int nr_added_bufs; |
| |
| spin_lock_init(&portdev->c_ivq_lock); |
| + spin_lock_init(&portdev->c_ovq_lock); |
| INIT_WORK(&portdev->control_work, &control_work_handler); |
| |
| nr_added_bufs = fill_queue(portdev->c_ivq, |
