From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F8CFC433FF for ; Fri, 2 Aug 2019 13:37:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2E07520679 for ; Fri, 2 Aug 2019 13:37:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564753034; bh=mYtGdZ3bEgDZIU4a5z2Ef2MN1WaWVMHiHfTai+XjY2o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=fXzcteQlYw2zeFaRDvYa8TUMhSGv3p7CzsSVL/t5fQvsTDQEkO2FDWC3IKIsc9NUC mq+A6Lq6X3aSBfizD2AnEzIRN1iwgN+WbhQ6XrwBy85xpz42vf1b00yr4npFFgEs5g ikuTFtIDLZWPCjCDmkls4h9sth8LrTaBvqHbXbBM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391128AbfHBNhN (ORCPT ); Fri, 2 Aug 2019 09:37:13 -0400 Received: from mail.kernel.org ([198.145.29.99]:58238 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2393230AbfHBNT5 (ORCPT ); Fri, 2 Aug 2019 09:19:57 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 44E2B217D6; Fri, 2 Aug 2019 13:19:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564751997; bh=mYtGdZ3bEgDZIU4a5z2Ef2MN1WaWVMHiHfTai+XjY2o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HUBOKe1GFHiukTxOh5gjWKJouLCmIM7ApwvDSnXdA630xZvmmkIqN4Zsjlq1tM7Ko DlUi4z4qUfKIz92JA2htrQN6wujHEh7Sb78ORrgv1GVoeW+1UmQ5W8lzKKBDwmO10p WpdtS7J4rops/V/ab0n61hZYybxzsx8oVP3I0cfo= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Farhan Ali , Cornelia Huck , Eric Farman , Sasha Levin , linux-s390@vger.kernel.org Subject: [PATCH AUTOSEL 5.2 04/76] vfio-ccw: Don't call cp_free if we are processing a channel program Date: Fri, 2 Aug 2019 09:18:38 -0400 Message-Id: <20190802131951.11600-4-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190802131951.11600-1-sashal@kernel.org> References: <20190802131951.11600-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Farhan Ali [ Upstream commit f4c9939433bd396d0b08e803b2b880a9d02682b9 ] There is a small window where it's possible that we could be working on an interrupt (queued in the workqueue) and setting up a channel program (i.e allocating memory, pinning pages, translating address). This can lead to allocating and freeing the channel program at the same time and can cause memory corruption. Let's not call cp_free if we are currently processing a channel program. The only way we know for sure that we don't have a thread setting up a channel program is when the state is set to VFIO_CCW_STATE_CP_PENDING. Fixes: d5afd5d135c8 ("vfio-ccw: add handling for async channel instructions") Signed-off-by: Farhan Ali Reviewed-by: Cornelia Huck Message-Id: <62e87bf67b38dc8d5760586e7c96d400db854ebe.1562854091.git.alifm@linux.ibm.com> Reviewed-by: Eric Farman Signed-off-by: Cornelia Huck Signed-off-by: Sasha Levin --- drivers/s390/cio/vfio_ccw_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c index 9125f7f4e64c9..8a8fbde7e1867 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -88,7 +88,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); if (scsw_is_solicited(&irb->scsw)) { cp_update_scsw(&private->cp, &irb->scsw); - if (is_final) + if (is_final && private->state == VFIO_CCW_STATE_CP_PENDING) cp_free(&private->cp); } mutex_lock(&private->io_mutex); -- 2.20.1