lkml.org 
[lkml]   [2019]   [Dec]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 157/162] vfio/pci: call irq_bypass_unregister_producer() before freeing irq
    Date
    From: Jiang Yi <giangyi@amazon.com>

    commit d567fb8819162099035e546b11a736e29c2af0ea upstream.

    Since irq_bypass_register_producer() is called after request_irq(), we
    should do tear-down in reverse order: irq_bypass_unregister_producer()
    then free_irq().

    Specifically free_irq() may release resources required by the
    irqbypass del_producer() callback. Notably an example provided by
    Marc Zyngier on arm64 with GICv4 that he indicates has the potential
    to wedge the hardware:

    free_irq(irq)
    __free_irq(irq)
    irq_domain_deactivate_irq(irq)
    its_irq_domain_deactivate()
    [unmap the VLPI from the ITS]

    kvm_arch_irq_bypass_del_producer(cons, prod)
    kvm_vgic_v4_unset_forwarding(kvm, irq, ...)
    its_unmap_vlpi(irq)
    [Unmap the VLPI from the ITS (again), remap the original LPI]

    Signed-off-by: Jiang Yi <giangyi@amazon.com>
    Cc: stable@vger.kernel.org # v4.4+
    Fixes: 6d7425f109d26 ("vfio: Register/unregister irq_bypass_producer")
    Link: https://lore.kernel.org/kvm/20191127164910.15888-1-giangyi@amazon.com
    Reviewed-by: Marc Zyngier <maz@kernel.org>
    Reviewed-by: Eric Auger <eric.auger@redhat.com>
    [aw: commit log]
    Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/vfio/pci/vfio_pci_intrs.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/vfio/pci/vfio_pci_intrs.c
    +++ b/drivers/vfio/pci/vfio_pci_intrs.c
    @@ -318,8 +318,8 @@ static int vfio_msi_set_vector_signal(st
    return -EINVAL;

    if (vdev->ctx[vector].trigger) {
    - free_irq(irq, vdev->ctx[vector].trigger);
    irq_bypass_unregister_producer(&vdev->ctx[vector].producer);
    + free_irq(irq, vdev->ctx[vector].trigger);
    kfree(vdev->ctx[vector].name);
    eventfd_ctx_put(vdev->ctx[vector].trigger);
    vdev->ctx[vector].trigger = NULL;

    \
     
     \ /
      Last update: 2019-12-19 20:08    [W:2.533 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site