Re: [PATCH v3 0/9] pseries/papr-hvpipe: Fix deadlock, races and misc cleanups

Re: [PATCH v3 0/9] pseries/papr-hvpipe: Fix deadlock, races and misc cleanups

[Aboorva Devarajan]

On Fri, 2026-05-01 at 09:41 +0530, Ritesh Harjani (IBM) wrote:
> While going over papr-hvpipe code, there were a few fixes which were identified.
> This patch series is an attempt to fix those along with some misc cleanups.
> Me and Haren are trying to get these patches verified on a real HW. The tests
> are not straight forward and we are waiting for the results.
> Will update on the test results once we hear back from the internal test team.
> 
> v2->v3:
> ======
> 1. Rearranged the patches in such a way that it is easier to backport the fixes
>    if required.
> 2. Clubbed patch-8 and patch-10 (of v2) since they both were changing the same function.
> 3. Handled ret>=0 case in copy_to_user patch, when the user itself may request
>    for 0 effective bytes (after the HDR_LEN).


Since this is CCed to stable, it is currently being evaluated by RSCT.
We can merge it once we receive an Acked-by from RSCT.

Thanks,
Aboorva

> 
> [v2]: https://lore.kernel.org/linuxppc-dev/cover.1775648406.git.ritesh.list@gmail.com/
> 
> v1->v2:
> ========
> 1. Fix a possible deadlock due to use of spin_lock instead of spin_lock_irqsave.
> 2. Prevent kernel stack uninit memory leak to userspace
> 3. Fix the race condition in null-ptr-deref case where there may be an
>    msg pending to be consumed from the hvpipe.
> 4. Fixed error handling in init routine in patch-10
> 
> [v1]: https://lore.kernel.org/linuxppc-dev/cover.1775569027.git.ritesh.list@gmail.com/#t
> 
> Ritesh Harjani (IBM) (9):
>   pseries/papr-hvpipe: Fix race with interrupt handler
>   pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
>   pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()
>   pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init()
>   pseries/papr-hvpipe: Fix the usage of copy_to_user()
>   pseries/papr-hvpipe: Simplify spin unlock usage in papr_hvpipe_handle_release()
>   pseries/papr-hvpipe: Kill task_struct pointer from struct hvpipe_source_info
>   pseries/papr-hvpipe: Refactor and simplify hvpipe_rtas_recv_msg()
>   pseries/papr-hvpipe: Fix style and checkpatch issues in enable_hvpipe_IRQ()
> 
>  arch/powerpc/platforms/pseries/papr-hvpipe.c | 181 ++++++++++---------
>  arch/powerpc/platforms/pseries/papr-hvpipe.h |   1 -
>  2 files changed, 97 insertions(+), 85 deletions(-)
> 
> --
> 2.39.5

Re: [PATCH v3 0/9] pseries/papr-hvpipe: Fix deadlock, races and misc cleanups

[Aboorva Devarajan]

On Fri, 2026-05-08 at 13:16 +0530, Aboorva Devarajan wrote:
> On Fri, 2026-05-01 at 09:41 +0530, Ritesh Harjani (IBM) wrote:
> > While going over papr-hvpipe code, there were a few fixes which were identified.
> > This patch series is an attempt to fix those along with some misc cleanups.
> > Me and Haren are trying to get these patches verified on a real HW. The tests
> > are not straight forward and we are waiting for the results.
> > Will update on the test results once we hear back from the internal test team.
> > 
> > v2->v3:
> > ======
> > 1. Rearranged the patches in such a way that it is easier to backport the fixes
> >    if required.
> > 2. Clubbed patch-8 and patch-10 (of v2) since they both were changing the same function.
> > 3. Handled ret>=0 case in copy_to_user patch, when the user itself may request
> >    for 0 effective bytes (after the HDR_LEN).
> 
> 
> Since this is CCed to stable, it is currently being evaluated by RSCT.
> We can merge it once we receive an Acked-by from RSCT.
> 
> 

An update from RSCT: with the patch, the earlier issues observed are
now resolved, and the inband RMC connection is successfully established
with the patched kernel.

Thanks,
Aboorva

> 
> > 
> > [v2]: https://lore.kernel.org/linuxppc-dev/cover.1775648406.git.ritesh.list@gmail.com/
> > 
> > v1->v2:
> > ========
> > 1. Fix a possible deadlock due to use of spin_lock instead of spin_lock_irqsave.
> > 2. Prevent kernel stack uninit memory leak to userspace
> > 3. Fix the race condition in null-ptr-deref case where there may be an
> >    msg pending to be consumed from the hvpipe.
> > 4. Fixed error handling in init routine in patch-10
> > 
> > [v1]: https://lore.kernel.org/linuxppc-dev/cover.1775569027.git.ritesh.list@gmail.com/#t
> > 
> > Ritesh Harjani (IBM) (9):
> >   pseries/papr-hvpipe: Fix race with interrupt handler
> >   pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
> >   pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()
> >   pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init()
> >   pseries/papr-hvpipe: Fix the usage of copy_to_user()
> >   pseries/papr-hvpipe: Simplify spin unlock usage in papr_hvpipe_handle_release()
> >   pseries/papr-hvpipe: Kill task_struct pointer from struct hvpipe_source_info
> >   pseries/papr-hvpipe: Refactor and simplify hvpipe_rtas_recv_msg()
> >   pseries/papr-hvpipe: Fix style and checkpatch issues in enable_hvpipe_IRQ()
> > 
> >  arch/powerpc/platforms/pseries/papr-hvpipe.c | 181 ++++++++++---------
> >  arch/powerpc/platforms/pseries/papr-hvpipe.h |   1 -
> >  2 files changed, 97 insertions(+), 85 deletions(-)
> > 
> > --
> > 2.39.5

Re: [PATCH v3 0/9] pseries/papr-hvpipe: Fix deadlock, races and misc cleanups

[Madhavan Srinivasan]

On Fri, 01 May 2026 09:41:39 +0530, Ritesh Harjani (IBM) wrote:
> While going over papr-hvpipe code, there were a few fixes which were identified.
> This patch series is an attempt to fix those along with some misc cleanups.
> Me and Haren are trying to get these patches verified on a real HW. The tests
> are not straight forward and we are waiting for the results.
> Will update on the test results once we hear back from the internal test team.
> 
> v2->v3:
> ======
> 1. Rearranged the patches in such a way that it is easier to backport the fixes
>    if required.
> 2. Clubbed patch-8 and patch-10 (of v2) since they both were changing the same function.
> 3. Handled ret>=0 case in copy_to_user patch, when the user itself may request
>    for 0 effective bytes (after the HDR_LEN).
> 
> [...]

Applied to powerpc/fixes.

[1/9] pseries/papr-hvpipe: Fix race with interrupt handler
      https://git.kernel.org/powerpc/c/7a4f0846ee6cc8cf44ae0046ed42e3259d1dd45b
[2/9] pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
      https://git.kernel.org/powerpc/c/cefeed44296261173a806bef988b26bc565da4be
[3/9] pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()
      https://git.kernel.org/powerpc/c/1b9f7aafa44f5ce852c00509104d10fd9eb0f402
[4/9] pseries/papr-hvpipe: Fix & simplify error handling in papr_hvpipe_init()
      https://git.kernel.org/powerpc/c/713e468cdbc2277db6ce949c32c1acbd83501733
[5/9] pseries/papr-hvpipe: Fix the usage of copy_to_user()
      https://git.kernel.org/powerpc/c/d48654bd8b1a75f662e224d257db54de475120dc
[6/9] pseries/papr-hvpipe: Simplify spin unlock usage in papr_hvpipe_handle_release()
      https://git.kernel.org/powerpc/c/2eeac577480848801b35885b3a8201aa35f46236
[7/9] pseries/papr-hvpipe: Kill task_struct pointer from struct hvpipe_source_info
      https://git.kernel.org/powerpc/c/4e2d83c80495a9327141e8636f25dde13155f14f
[8/9] pseries/papr-hvpipe: Refactor and simplify hvpipe_rtas_recv_msg()
      https://git.kernel.org/powerpc/c/fe53d2ae82c06aa2d6402624af01e8f8ddfcd5b3
[9/9] pseries/papr-hvpipe: Fix style and checkpatch issues in enable_hvpipe_IRQ()
      https://git.kernel.org/powerpc/c/629d1a901de57490d29a495273df11e64993ec04

cheers