Re: [PATCH v1] vfio/ccw: Flush notoper_work before returning from reset

[sashiko-bot@kernel.org]

> vfio_ccw_dma_unmap() is the DMA invalidation callback, which must unpin
> the pages covering the range before it returns.  It calls
> vfio_ccw_mdev_reset(), which raises a CLOSE event.
> 
> On the normal path fsm_close() calls cp_free() itself, so the pages are
> unpinned synchronously.  But if the subchannel cannot be disabled or
> quiesced, fsm_close() falls through to a NOT_OPER event, and fsm_notoper()
> only queues notoper_work, which is where cp_free() then runs.  Nothing
> waits for that work, so the callback returns with the pages still pinned.
> 
> Because notoper_work runs asynchronously, vfio_dma_do_unmap() can exhaust
> its 10 retries before cp_free() completes, hitting BUG_ON(++retries > 10)
> and taking the host down.  A further CLOSE cannot help either, as both
> CLOSE and OPEN are fsm_nop in the NOT_OPER state.
> 
> Flush notoper_work after the CLOSE event, as vfio_ccw_mdev_close_device()
> already does for the same reason.  The flush returns immediately when the
> work was never queued, so the normal path is unaffected.
> 
> Fixes: ce4b4657ff18 ("vfio: Replace the DMA unmapping notifier with a callback")
> Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922164928.477669-1-oss.patchbox@gmail.com?part=1