[PATCH 1/2] vmbus: unregister device_obj->channels_kset

[PATCH 1/2] vmbus: unregister device_obj->channels_kset

[kys]

From: Dexuan Cui <decui@microsoft.com>

Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")

Without the patch, a device can't be thoroughly destroyed, because
vmbus_device_register() -> kset_create_and_add() still holds a reference
to the hv_device's device.kobj.

Signed-off-by: Dexuan Cui <decui@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
---
 drivers/hv/vmbus_drv.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index 6a86746..4f3faf5 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -1378,6 +1378,8 @@ void vmbus_device_unregister(struct hv_device *device_obj)
 	pr_debug("child device %s unregistered\n",
 		dev_name(&device_obj->device));
 
+	kset_unregister(device_obj->channels_kset);
+
 	/*
 	 * Kick off the process of unregistering the device.
 	 * This will call vmbus_remove() and eventually vmbus_device_release()
-- 
1.7.1

Re: [PATCH 1/2] vmbus: unregister device_obj->channels_kset

[Greg KH]

On Tue, Nov 14, 2017 at 06:53:32AM -0700, kys@exchange.microsoft.com wrote:
> From: Dexuan Cui <decui@microsoft.com>
> 
> Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")
> 
> Without the patch, a device can't be thoroughly destroyed, because
> vmbus_device_register() -> kset_create_and_add() still holds a reference
> to the hv_device's device.kobj.
> 
> Signed-off-by: Dexuan Cui <decui@microsoft.com>
> Cc: Stephen Hemminger <sthemmin@microsoft.com>
> Cc: stable@vger.kernel.org

Why is this marked for stable when the patch it "fixes" is in 4.15-rc1?

Re: [PATCH 1/2] vmbus: unregister device_obj->channels_kset

[Stephen Hemminger]

On Tue, 28 Nov 2017 16:56:05 +0100
Greg KH <gregkh@linuxfoundation.org> wrote:

> On Tue, Nov 14, 2017 at 06:53:32AM -0700, kys@exchange.microsoft.com wrote:
> > From: Dexuan Cui <decui@microsoft.com>
> > 
> > Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")
> > 
> > Without the patch, a device can't be thoroughly destroyed, because
> > vmbus_device_register() -> kset_create_and_add() still holds a reference
> > to the hv_device's device.kobj.
> > 
> > Signed-off-by: Dexuan Cui <decui@microsoft.com>
> > Cc: Stephen Hemminger <sthemmin@microsoft.com>
> > Cc: stable@vger.kernel.org  
> 
> Why is this marked for stable when the patch it "fixes" is in 4.15-rc1?

It doesn't need to go to stable.

RE: [PATCH 1/2] vmbus: unregister device_obj->channels_kset

[Dexuan Cui]

> From: devel [mailto:driverdev-devel-bounces@linuxdriverproject.org] On
> Behalf Of Stephen Hemminger
> Sent: Tuesday, November 28, 2017 9:30 AM
> To: Greg KH <gregkh@linuxfoundation.org>
> Cc: olaf@aepfle.de; Stephen Hemminger <sthemmin@microsoft.com>;
> jasowang@redhat.com; linux-kernel@vger.kernel.org; stable@vger.kernel.org;
> apw@canonical.com; marcelo.cerri@canonical.com;
> devel@linuxdriverproject.org; vkuznets@redhat.com;
> leann.ogasawara@canonical.com
> Subject: Re: [PATCH 1/2] vmbus: unregister device_obj->channels_kset
> 
> On Tue, 28 Nov 2017 16:56:05 +0100
> Greg KH <gregkh@linuxfoundation.org> wrote:
> 
> > On Tue, Nov 14, 2017 at 06:53:32AM -0700, kys@exchange.microsoft.com
> wrote:
> > > From: Dexuan Cui <decui@microsoft.com>
> > >
> > > Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")
> > >
> > > Without the patch, a device can't be thoroughly destroyed, because
> > > vmbus_device_register() -> kset_create_and_add() still holds a reference
> > > to the hv_device's device.kobj.
> > >
> > > Signed-off-by: Dexuan Cui <decui@microsoft.com>
> > > Cc: Stephen Hemminger <sthemmin@microsoft.com>
> > > Cc: stable@vger.kernel.org
> >
> > Why is this marked for stable when the patch it "fixes" is in 4.15-rc1?
> 
> It doesn't need to go to stable.

Hi Greg,
May I know the status of the patch?

Thanks,
-- Dexuan

Re: [PATCH 1/2] vmbus: unregister device_obj->channels_kset

[Greg KH]

On Mon, Dec 11, 2017 at 08:41:44PM +0000, Dexuan Cui wrote:
> > From: devel [mailto:driverdev-devel-bounces@linuxdriverproject.org] On
> > Behalf Of Stephen Hemminger
> > Sent: Tuesday, November 28, 2017 9:30 AM
> > To: Greg KH <gregkh@linuxfoundation.org>
> > Cc: olaf@aepfle.de; Stephen Hemminger <sthemmin@microsoft.com>;
> > jasowang@redhat.com; linux-kernel@vger.kernel.org; stable@vger.kernel.org;
> > apw@canonical.com; marcelo.cerri@canonical.com;
> > devel@linuxdriverproject.org; vkuznets@redhat.com;
> > leann.ogasawara@canonical.com
> > Subject: Re: [PATCH 1/2] vmbus: unregister device_obj->channels_kset
> > 
> > On Tue, 28 Nov 2017 16:56:05 +0100
> > Greg KH <gregkh@linuxfoundation.org> wrote:
> > 
> > > On Tue, Nov 14, 2017 at 06:53:32AM -0700, kys@exchange.microsoft.com
> > wrote:
> > > > From: Dexuan Cui <decui@microsoft.com>
> > > >
> > > > Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")
> > > >
> > > > Without the patch, a device can't be thoroughly destroyed, because
> > > > vmbus_device_register() -> kset_create_and_add() still holds a reference
> > > > to the hv_device's device.kobj.
> > > >
> > > > Signed-off-by: Dexuan Cui <decui@microsoft.com>
> > > > Cc: Stephen Hemminger <sthemmin@microsoft.com>
> > > > Cc: stable@vger.kernel.org
> > >
> > > Why is this marked for stable when the patch it "fixes" is in 4.15-rc1?
> > 
> > It doesn't need to go to stable.
> 
> Hi Greg,
> May I know the status of the patch?

It's still in my "to-apply" queue.  As it's only a 4.15-final thing,
don't worry, it will get there...

thanks,

greg k-h

RE: [PATCH 1/2] vmbus: unregister device_obj->channels_kset

[Dexuan Cui]

> From: Greg KH [mailto:gregkh@linuxfoundation.org]
> Sent: Monday, December 11, 2017 12:59 PM
> To: Dexuan Cui <decui@microsoft.com>
> Cc: Stephen Hemminger <stephen@networkplumber.org>; olaf@aepfle.de;
> Stephen Hemminger <sthemmin@microsoft.com>; jasowang@redhat.com;
> linux-kernel@vger.kernel.org; stable@vger.kernel.org; apw@canonical.com;
> marcelo.cerri@canonical.com; devel@linuxdriverproject.org;
> vkuznets@redhat.com; leann.ogasawara@canonical.com
> Subject: Re: [PATCH 1/2] vmbus: unregister device_obj->channels_kset
> 
> On Mon, Dec 11, 2017 at 08:41:44PM +0000, Dexuan Cui wrote:
> > > From: devel [mailto:driverdev-devel-bounces@linuxdriverproject.org] On
> > > Behalf Of Stephen Hemminger
> > > Sent: Tuesday, November 28, 2017 9:30 AM
> > > To: Greg KH <gregkh@linuxfoundation.org>
> > > Cc: olaf@aepfle.de; Stephen Hemminger <sthemmin@microsoft.com>;
> > > jasowang@redhat.com; linux-kernel@vger.kernel.org;
> stable@vger.kernel.org;
> > > apw@canonical.com; marcelo.cerri@canonical.com;
> > > devel@linuxdriverproject.org; vkuznets@redhat.com;
> > > leann.ogasawara@canonical.com
> > > Subject: Re: [PATCH 1/2] vmbus: unregister device_obj->channels_kset
> > >
> > > On Tue, 28 Nov 2017 16:56:05 +0100
> > > Greg KH <gregkh@linuxfoundation.org> wrote:
> > >
> > > > On Tue, Nov 14, 2017 at 06:53:32AM -0700,
> kys@exchange.microsoft.com
> > > wrote:
> > > > > From: Dexuan Cui <decui@microsoft.com>
> > > > >
> > > > > Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")
> > > > >
> > > > > Without the patch, a device can't be thoroughly destroyed, because
> > > > > vmbus_device_register() -> kset_create_and_add() still holds a reference
> > > > > to the hv_device's device.kobj.
> > > > >
> > > > > Signed-off-by: Dexuan Cui <decui@microsoft.com>
> > > > > Cc: Stephen Hemminger <sthemmin@microsoft.com>
> > > > > Cc: stable@vger.kernel.org
> > > >
> > > > Why is this marked for stable when the patch it "fixes" is in 4.15-rc1?
> > >
> > > It doesn't need to go to stable.
> >
> > Hi Greg,
> > May I know the status of the patch?
> 
> It's still in my "to-apply" queue.  As it's only a 4.15-final thing,
> don't worry, it will get there...
> 
> thanks,
> 
> greg k-h

Thanks a lot, Greg!

-- Dexuan

[PATCH 2/2] Drivers: hv: vmbus: Fix a rescind issue

[kys]

From: K. Y. Srinivasan <kys@microsoft.com>

The current rescind processing code will not correctly handle
the case where the host immediately rescinds a channel that has
been offerred. In this case, we could be blocked in the open call and
since the channel is rescinded, the host will not respond and we could
be blocked forever in the vmbus open call.i Fix this problem.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Cc: stable@vger.kernel.org
---
 drivers/hv/channel.c      |   10 ++++++++--
 drivers/hv/channel_mgmt.c |    7 ++++---
 include/linux/hyperv.h    |    1 +
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 19f0cf3..ba0a092 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -659,22 +659,28 @@ void vmbus_close(struct vmbus_channel *channel)
 		 */
 		return;
 	}
-	mutex_lock(&vmbus_connection.channel_mutex);
 	/*
 	 * Close all the sub-channels first and then close the
 	 * primary channel.
 	 */
 	list_for_each_safe(cur, tmp, &channel->sc_list) {
 		cur_channel = list_entry(cur, struct vmbus_channel, sc_list);
-		vmbus_close_internal(cur_channel);
 		if (cur_channel->rescind) {
+			wait_for_completion(&cur_channel->rescind_event);
+			mutex_lock(&vmbus_connection.channel_mutex);
+			vmbus_close_internal(cur_channel);
 			hv_process_channel_removal(
 					   cur_channel->offermsg.child_relid);
+		} else {
+			mutex_lock(&vmbus_connection.channel_mutex);
+			vmbus_close_internal(cur_channel);
 		}
+		mutex_unlock(&vmbus_connection.channel_mutex);
 	}
 	/*
 	 * Now close the primary.
 	 */
+	mutex_lock(&vmbus_connection.channel_mutex);
 	vmbus_close_internal(channel);
 	mutex_unlock(&vmbus_connection.channel_mutex);
 }
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index ec5454f..c21020b 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -333,6 +333,7 @@ bool vmbus_prep_negotiate_resp(struct icmsg_hdr *icmsghdrp,
 		return NULL;
 
 	spin_lock_init(&channel->lock);
+	init_completion(&channel->rescind_event);
 
 	INIT_LIST_HEAD(&channel->sc_list);
 	INIT_LIST_HEAD(&channel->percpu_list);
@@ -898,6 +899,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
 	/*
 	 * Now wait for offer handling to complete.
 	 */
+	vmbus_rescind_cleanup(channel);
 	while (READ_ONCE(channel->probe_done) == false) {
 		/*
 		 * We wait here until any channel offer is currently
@@ -913,7 +915,6 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
 	if (channel->device_obj) {
 		if (channel->chn_rescind_callback) {
 			channel->chn_rescind_callback(channel);
-			vmbus_rescind_cleanup(channel);
 			return;
 		}
 		/*
@@ -922,7 +923,6 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
 		 */
 		dev = get_device(&channel->device_obj->device);
 		if (dev) {
-			vmbus_rescind_cleanup(channel);
 			vmbus_device_unregister(channel->device_obj);
 			put_device(dev);
 		}
@@ -936,13 +936,14 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
 		 * 2. Then close the primary channel.
 		 */
 		mutex_lock(&vmbus_connection.channel_mutex);
-		vmbus_rescind_cleanup(channel);
 		if (channel->state == CHANNEL_OPEN_STATE) {
 			/*
 			 * The channel is currently not open;
 			 * it is safe for us to cleanup the channel.
 			 */
 			hv_process_channel_removal(rescind->child_relid);
+		} else {
+			complete(&channel->rescind_event);
 		}
 		mutex_unlock(&vmbus_connection.channel_mutex);
 	}
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index f3e97c5..6c93366 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -708,6 +708,7 @@ struct vmbus_channel {
 	u8 monitor_bit;
 
 	bool rescind; /* got rescind msg */
+	struct completion rescind_event;
 
 	u32 ringbuffer_gpadlhandle;
 
-- 
1.7.1