From: Alex Williamson <alex@shazbot.org>
To: "Jinhui Guo" <guojinhui.liam@bytedance.com>,
"Yishai Hadas" <yishaih@nvidia.com>
Cc: "Jason Gunthorpe" <jgg@ziepe.ca>,
"Shameer Kolothum" <skolothumtho@nvidia.com>,
"Kevin Tian" <kevin.tian@intel.com>, <kvm@vger.kernel.org>,
<virtualization@lists.linux.dev>, <linux-kernel@vger.kernel.org>,
<stable@vger.kernel.org>,
alex@shazbot.org
Subject: Re: [RESEND PATCH] vfio/virtio: Fix lock/unlock mismatch in virtiovf_read_device_context_chunk()
Date: Mon, 13 Apr 2026 14:08:15 -0600 [thread overview]
Message-ID: <20260413140815.3ada32eb@shazbot.org> (raw)
In-Reply-To: <20260413073603.30538-1-guojinhui.liam@bytedance.com>
On Mon, 13 Apr 2026 15:36:03 +0800
"Jinhui Guo" <guojinhui.liam@bytedance.com> wrote:
> virtiovf_read_device_context_chunk() takes migf->list_lock with
> spin_lock() but releases it with spin_unlock_irq(). This mismatch
> can incorrectly enable interrupts if they were already disabled
> when the lock was acquired, leading to unbalanced IRQ state.
>
> Fix by using spin_lock_irq() to match spin_unlock_irq().
>
> Fixes: 0bbc82e4ec79 ("vfio/virtio: Add support for the basic live migration functionality")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
> ---
> drivers/vfio/pci/virtio/migrate.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/vfio/pci/virtio/migrate.c b/drivers/vfio/pci/virtio/migrate.c
> index 35fa2d6ed611..9fc24788fc04 100644
> --- a/drivers/vfio/pci/virtio/migrate.c
> +++ b/drivers/vfio/pci/virtio/migrate.c
> @@ -621,7 +621,7 @@ virtiovf_read_device_context_chunk(struct virtiovf_migration_file *migf,
>
> buf->start_pos = buf->migf->max_pos;
> migf->max_pos += buf->length;
> - spin_lock(&migf->list_lock);
> + spin_lock_irq(&migf->list_lock);
> list_add_tail(&buf->buf_elm, &migf->buf_list);
> spin_unlock_irq(&migf->list_lock);
> return 0;
Yes, that fixes the bug, but why are we using a spinlock-irq here in
the first place? I think this just copied the mlx5 vfio-pci variant
driver, which does make use of their list_lock under hardirq context,
but no such use case exists in this virtio driver.
A more complete fix would be to to convert list_lock to a mutex.
Thanks,
Alex
prev parent reply other threads:[~2026-04-13 20:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-13 7:36 [RESEND PATCH] vfio/virtio: Fix lock/unlock mismatch in virtiovf_read_device_context_chunk() Jinhui Guo
2026-04-13 20:08 ` Alex Williamson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260413140815.3ada32eb@shazbot.org \
--to=alex@shazbot.org \
--cc=guojinhui.liam@bytedance.com \
--cc=jgg@ziepe.ca \
--cc=kevin.tian@intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=skolothumtho@nvidia.com \
--cc=stable@vger.kernel.org \
--cc=virtualization@lists.linux.dev \
--cc=yishaih@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox