public inbox for kvm@vger.kernel.org
 help / color / mirror / Atom feed
From: Alex Williamson <alex@shazbot.org>
To: "Jinhui Guo" <guojinhui.liam@bytedance.com>,
	"Yishai Hadas" <yishaih@nvidia.com>
Cc: "Jason Gunthorpe" <jgg@ziepe.ca>,
	"Shameer Kolothum" <skolothumtho@nvidia.com>,
	"Kevin Tian" <kevin.tian@intel.com>, <kvm@vger.kernel.org>,
	<virtualization@lists.linux.dev>, <linux-kernel@vger.kernel.org>,
	<stable@vger.kernel.org>,
	alex@shazbot.org
Subject: Re: [RESEND PATCH] vfio/virtio: Fix lock/unlock mismatch in virtiovf_read_device_context_chunk()
Date: Mon, 13 Apr 2026 14:08:15 -0600	[thread overview]
Message-ID: <20260413140815.3ada32eb@shazbot.org> (raw)
In-Reply-To: <20260413073603.30538-1-guojinhui.liam@bytedance.com>

On Mon, 13 Apr 2026 15:36:03 +0800
"Jinhui Guo" <guojinhui.liam@bytedance.com> wrote:

> virtiovf_read_device_context_chunk() takes migf->list_lock with
> spin_lock() but releases it with spin_unlock_irq().  This mismatch
> can incorrectly enable interrupts if they were already disabled
> when the lock was acquired, leading to unbalanced IRQ state.
> 
> Fix by using spin_lock_irq() to match spin_unlock_irq().
> 
> Fixes: 0bbc82e4ec79 ("vfio/virtio: Add support for the basic live migration functionality")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
> ---
>  drivers/vfio/pci/virtio/migrate.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/vfio/pci/virtio/migrate.c b/drivers/vfio/pci/virtio/migrate.c
> index 35fa2d6ed611..9fc24788fc04 100644
> --- a/drivers/vfio/pci/virtio/migrate.c
> +++ b/drivers/vfio/pci/virtio/migrate.c
> @@ -621,7 +621,7 @@ virtiovf_read_device_context_chunk(struct virtiovf_migration_file *migf,
>  
>  	buf->start_pos = buf->migf->max_pos;
>  	migf->max_pos += buf->length;
> -	spin_lock(&migf->list_lock);
> +	spin_lock_irq(&migf->list_lock);
>  	list_add_tail(&buf->buf_elm, &migf->buf_list);
>  	spin_unlock_irq(&migf->list_lock);
>  	return 0;

Yes, that fixes the bug, but why are we using a spinlock-irq here in
the first place?  I think this just copied the mlx5 vfio-pci variant
driver, which does make use of their list_lock under hardirq context,
but no such use case exists in this virtio driver.

A more complete fix would be to to convert list_lock to a mutex.
Thanks,

Alex

      reply	other threads:[~2026-04-13 20:08 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-13  7:36 [RESEND PATCH] vfio/virtio: Fix lock/unlock mismatch in virtiovf_read_device_context_chunk() Jinhui Guo
2026-04-13 20:08 ` Alex Williamson [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260413140815.3ada32eb@shazbot.org \
    --to=alex@shazbot.org \
    --cc=guojinhui.liam@bytedance.com \
    --cc=jgg@ziepe.ca \
    --cc=kevin.tian@intel.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=skolothumtho@nvidia.com \
    --cc=stable@vger.kernel.org \
    --cc=virtualization@lists.linux.dev \
    --cc=yishaih@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox