From mboxrd@z Thu Jan  1 00:00:00 1970
From: Auger Eric <eric.auger@redhat.com>
Subject: Re: [PATCH 1/7] vfio: Fix group release deadlock
Date: Wed, 14 Jun 2017 14:31:41 +0200
Message-ID: <152e466a-ab00-60ee-7ebf-05ed79272d80@redhat.com>
References: <20170609215816.31986.89321.stgit@gimli.home>
 <20170609215934.31986.87512.stgit@gimli.home>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Cc: linux-kernel@vger.kernel.org
To: Alex Williamson <alex.williamson@redhat.com>, kvm@vger.kernel.org
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <20170609215934.31986.87512.stgit@gimli.home>
Sender: linux-kernel-owner@vger.kernel.org
List-Id: kvm.vger.kernel.org

Hi Alex,

On 09/06/2017 23:59, Alex Williamson wrote:
> If vfio_iommu_group_notifier() acquires a group reference and that
> reference becomes the last reference to the group, then vfio_group_put
> introduces a deadlock code path where we're trying to unregister from
> the iommu notifier chain from within a callout of that chain.  Use a
> work_struct to release this reference asynchronously.
> 
> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
> ---
>  drivers/vfio/vfio.c |   37 ++++++++++++++++++++++++++++++++++++-
>  1 file changed, 36 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
> index 561084ab387f..f2e24d5699f2 100644
> --- a/drivers/vfio/vfio.c
> +++ b/drivers/vfio/vfio.c
> @@ -423,6 +423,34 @@ static void vfio_group_put(struct vfio_group *group)
>  	kref_put_mutex(&group->kref, vfio_group_release, &vfio.group_lock);
>  }
>  
> +struct vfio_group_put_work {
> +	struct work_struct work;
> +	struct vfio_group *group;
> +};
> +
> +static void vfio_group_put_bg(struct work_struct *work)
> +{
> +	struct vfio_group_put_work *do_work;
> +
> +	do_work = container_of(work, struct vfio_group_put_work, work);
> +
> +	vfio_group_put(do_work->group);
> +	kfree(do_work);
> +}
> +
> +static void vfio_group_schedule_put(struct vfio_group *group)
> +{
> +	struct vfio_group_put_work *do_work;
> +
> +	do_work = kmalloc(sizeof(*do_work), GFP_KERNEL);
> +	if (WARN_ON(!do_work))
> +		return;
> +
> +	INIT_WORK(&do_work->work, vfio_group_put_bg);
> +	do_work->group = group;
> +	schedule_work(&do_work->work);
> +}
> +
>  /* Assume group_lock or group reference is held */
>  static void vfio_group_get(struct vfio_group *group)
>  {
> @@ -762,7 +790,14 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb,
>  		break;
>  	}
>  
> -	vfio_group_put(group);
> +	/*
> +	 * If we're the last reference to the group, the group will be
> +	 * released, which includes unregistering the iommu group notifier.
> +	 * We hold a read-lock on that notifier list, unregistering needs
> +	 * a write-lock... deadlock.  Release our reference asyncronously
nit: s/asyncronously/asynchronously

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Thanks

Eric


> +	 * to avoid that situation.
> +	 */
> +	vfio_group_schedule_put(group);
>  	return NOTIFY_OK;
>  }
>  
>