* [PATCH 1/1] Drivers: hv: Fix bad ref to hv_synic_eventring_tail when CPU goes offline
@ 2025-04-21 16:31 mhkelley58
2025-04-23 17:50 ` Nuno Das Neves
0 siblings, 1 reply; 3+ messages in thread
From: mhkelley58 @ 2025-04-21 16:31 UTC (permalink / raw)
To: haiyangz, wei.liu, decui, kys, nunodasneves, linux-kernel,
linux-hyperv
From: Michael Kelley <mhklinux@outlook.com>
When a CPU goes offline, hv_common_cpu_die() frees the
hv_synic_eventring_tail memory for the CPU. But in a normal VM (i.e., not
running in the root partition) the per-CPU memory has not been allocated,
resulting in a bad memory reference and oops when computing the argument
to kfree().
Fix this by freeing the memory only when running in the root partition.
Fixes: 04df7ac39943 ("Drivers: hv: Introduce per-cpu event ring tail")
Signed-off-by: Michael Kelley <mhklinux@outlook.com>
---
drivers/hv/hv_common.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/hv/hv_common.c b/drivers/hv/hv_common.c
index b3b11be11650..8967010db86a 100644
--- a/drivers/hv/hv_common.c
+++ b/drivers/hv/hv_common.c
@@ -566,9 +566,11 @@ int hv_common_cpu_die(unsigned int cpu)
* originally allocated memory is reused in hv_common_cpu_init().
*/
- synic_eventring_tail = this_cpu_ptr(hv_synic_eventring_tail);
- kfree(*synic_eventring_tail);
- *synic_eventring_tail = NULL;
+ if (hv_root_partition()) {
+ synic_eventring_tail = this_cpu_ptr(hv_synic_eventring_tail);
+ kfree(*synic_eventring_tail);
+ *synic_eventring_tail = NULL;
+ }
return 0;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] Drivers: hv: Fix bad ref to hv_synic_eventring_tail when CPU goes offline
2025-04-21 16:31 [PATCH 1/1] Drivers: hv: Fix bad ref to hv_synic_eventring_tail when CPU goes offline mhkelley58
@ 2025-04-23 17:50 ` Nuno Das Neves
2025-04-25 6:25 ` Wei Liu
0 siblings, 1 reply; 3+ messages in thread
From: Nuno Das Neves @ 2025-04-23 17:50 UTC (permalink / raw)
To: mhklinux, haiyangz, wei.liu, decui, kys, linux-kernel,
linux-hyperv
On 4/21/2025 9:31 AM, mhkelley58@gmail.com wrote:
> From: Michael Kelley <mhklinux@outlook.com>
>
> When a CPU goes offline, hv_common_cpu_die() frees the
> hv_synic_eventring_tail memory for the CPU. But in a normal VM (i.e., not
> running in the root partition) the per-CPU memory has not been allocated,
> resulting in a bad memory reference and oops when computing the argument
> to kfree().
>
> Fix this by freeing the memory only when running in the root partition.
>
> Fixes: 04df7ac39943 ("Drivers: hv: Introduce per-cpu event ring tail")
> Signed-off-by: Michael Kelley <mhklinux@outlook.com>
> ---
> drivers/hv/hv_common.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/hv/hv_common.c b/drivers/hv/hv_common.c
> index b3b11be11650..8967010db86a 100644
> --- a/drivers/hv/hv_common.c
> +++ b/drivers/hv/hv_common.c
> @@ -566,9 +566,11 @@ int hv_common_cpu_die(unsigned int cpu)
> * originally allocated memory is reused in hv_common_cpu_init().
> */
>
> - synic_eventring_tail = this_cpu_ptr(hv_synic_eventring_tail);
> - kfree(*synic_eventring_tail);
> - *synic_eventring_tail = NULL;
> + if (hv_root_partition()) {
> + synic_eventring_tail = this_cpu_ptr(hv_synic_eventring_tail);
> + kfree(*synic_eventring_tail);
> + *synic_eventring_tail = NULL;
> + }
>
> return 0;
> }
Reviewed-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 1/1] Drivers: hv: Fix bad ref to hv_synic_eventring_tail when CPU goes offline
2025-04-23 17:50 ` Nuno Das Neves
@ 2025-04-25 6:25 ` Wei Liu
0 siblings, 0 replies; 3+ messages in thread
From: Wei Liu @ 2025-04-25 6:25 UTC (permalink / raw)
To: Nuno Das Neves
Cc: mhklinux, haiyangz, wei.liu, decui, kys, linux-kernel,
linux-hyperv
On Wed, Apr 23, 2025 at 10:50:27AM -0700, Nuno Das Neves wrote:
> On 4/21/2025 9:31 AM, mhkelley58@gmail.com wrote:
> > From: Michael Kelley <mhklinux@outlook.com>
> >
> > When a CPU goes offline, hv_common_cpu_die() frees the
> > hv_synic_eventring_tail memory for the CPU. But in a normal VM (i.e., not
> > running in the root partition) the per-CPU memory has not been allocated,
> > resulting in a bad memory reference and oops when computing the argument
> > to kfree().
> >
> > Fix this by freeing the memory only when running in the root partition.
> >
> > Fixes: 04df7ac39943 ("Drivers: hv: Introduce per-cpu event ring tail")
> > Signed-off-by: Michael Kelley <mhklinux@outlook.com>
> > ---
> > drivers/hv/hv_common.c | 8 +++++---
> > 1 file changed, 5 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/hv/hv_common.c b/drivers/hv/hv_common.c
> > index b3b11be11650..8967010db86a 100644
> > --- a/drivers/hv/hv_common.c
> > +++ b/drivers/hv/hv_common.c
> > @@ -566,9 +566,11 @@ int hv_common_cpu_die(unsigned int cpu)
> > * originally allocated memory is reused in hv_common_cpu_init().
> > */
> >
> > - synic_eventring_tail = this_cpu_ptr(hv_synic_eventring_tail);
> > - kfree(*synic_eventring_tail);
> > - *synic_eventring_tail = NULL;
> > + if (hv_root_partition()) {
> > + synic_eventring_tail = this_cpu_ptr(hv_synic_eventring_tail);
> > + kfree(*synic_eventring_tail);
> > + *synic_eventring_tail = NULL;
> > + }
> >
> > return 0;
> > }
>
> Reviewed-by: Nuno Das Neves <nunodasneves@linux.microsoft.com>
Applied to hyperv-fixes.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-04-25 6:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-04-21 16:31 [PATCH 1/1] Drivers: hv: Fix bad ref to hv_synic_eventring_tail when CPU goes offline mhkelley58
2025-04-23 17:50 ` Nuno Das Neves
2025-04-25 6:25 ` Wei Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox