Commit 2448a299 authored by Halil Pasic's avatar Halil Pasic Committed by Michael S. Tsirkin
Browse files

virtio/s390: avoid race on vcdev->config 



Currently we have a race on vcdev->config in virtio_ccw_get_config() and
in virtio_ccw_set_config().

This normally does not cause problems, as these are usually infrequent
operations. However, for some devices writing to/reading from the config
space can be triggered through sysfs attributes. For these, userspace can
force the race by increasing the frequency.

Signed-off-by: default avatarHalil Pasic <pasic@linux.ibm.com>
Cc: stable@vger.kernel.org
Message-Id: <20180925121309.58524-2-pasic@linux.ibm.com>
Signed-off-by: default avatarCornelia Huck <cohuck@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent c38f57da

drivers/s390/virtio/virtio_ccw.c

+8 −2
Original line number Diff line number Diff line
@@ -828,6 +828,7 @@ static void virtio_ccw_get_config(struct virtio_device *vdev, 
	int ret;

	struct ccw1 *ccw;

	void *config_area;

	unsigned long flags;



	ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);

	if (!ccw)
@@ -846,11 +847,13 @@ static void virtio_ccw_get_config(struct virtio_device *vdev, 
	if (ret)

		goto out_free;



	spin_lock_irqsave(&vcdev->lock, flags);

	memcpy(vcdev->config, config_area, offset + len);

	if (buf)

		memcpy(buf, &vcdev->config[offset], len);

	if (vcdev->config_ready < offset + len)

		vcdev->config_ready = offset + len;

	spin_unlock_irqrestore(&vcdev->lock, flags);

	if (buf)

		memcpy(buf, config_area + offset, len);



out_free:

	kfree(config_area);
@@ -864,6 +867,7 @@ static void virtio_ccw_set_config(struct virtio_device *vdev, 
	struct virtio_ccw_device *vcdev = to_vc_device(vdev);

	struct ccw1 *ccw;

	void *config_area;

	unsigned long flags;



	ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);

	if (!ccw)
@@ -876,9 +880,11 @@ static void virtio_ccw_set_config(struct virtio_device *vdev, 
	/* Make sure we don't overwrite fields. */

	if (vcdev->config_ready < offset)

		virtio_ccw_get_config(vdev, 0, NULL, offset);

	spin_lock_irqsave(&vcdev->lock, flags);

	memcpy(&vcdev->config[offset], buf, len);

	/* Write the config area to the host. */

	memcpy(config_area, vcdev->config, sizeof(vcdev->config));

	spin_unlock_irqrestore(&vcdev->lock, flags);

	ccw->cmd_code = CCW_CMD_WRITE_CONF;

	ccw->flags = 0;

	ccw->count = offset + len;

CRA Git | Maintained and supported by SUSTech CRA and CCSE