From patchwork Tue Dec 17 16:07:46 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: SeongJae Park X-Patchwork-Id: 11298067 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C7966139A for ; Tue, 17 Dec 2019 16:10:06 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A2AC121582 for ; Tue, 17 Dec 2019 16:10:06 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=amazon.com header.i=@amazon.com header.b="EkarZcfb" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A2AC121582 Authentication-Results: mail.kernel.org; dmarc=fail (p=quarantine dis=none) header.from=amazon.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1ihFPL-0006ER-1Z; Tue, 17 Dec 2019 16:09:11 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1ihFPJ-0006E4-DH for xen-devel@lists.xenproject.org; Tue, 17 Dec 2019 16:09:09 +0000 X-Inumbo-ID: 8dbaf349-20e7-11ea-8f0d-12813bfff9fa Received: from smtp-fw-6001.amazon.com (unknown [52.95.48.154]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 8dbaf349-20e7-11ea-8f0d-12813bfff9fa; Tue, 17 Dec 2019 16:09:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1576598949; x=1608134949; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=NVFC9qV2eoj93ZmYEaKEr4kRRmxcwtF4qCgUA1XgM8c=; b=EkarZcfbcLJiis14U3PlfKnn6WCG2T4H2I9FImCZfSU72ll8FOptUeAg mP0bBhdKvzCEULJS3p7ITdWfwM8+JtZxucLXEksFFu4CXpfawlJyY9c6q 7m022sikd171xcVfcxZu2Fepb5WeUA/VBdjZoXb2vs4DzevMz9NlbqN/G s=; IronPort-SDR: aRO1wLh9GqAmNNqsU3pay3V9ZmFMs4xiqfcPlG864PHeqR5P2dbee9CuQQFkIOZkbpvnzYiCR+ QfjSy1l0Ljog== X-IronPort-AV: E=Sophos;i="5.69,326,1571702400"; d="scan'208";a="9472487" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-2b-55156cd4.us-west-2.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-6001.iad6.amazon.com with ESMTP; 17 Dec 2019 16:09:08 +0000 Received: from EX13MTAUEA002.ant.amazon.com (pdx4-ws-svc-p6-lb7-vlan2.pdx.amazon.com [10.170.41.162]) by email-inbound-relay-2b-55156cd4.us-west-2.amazon.com (Postfix) with ESMTPS id 7C933A21FC; Tue, 17 Dec 2019 16:09:06 +0000 (UTC) Received: from EX13D31EUA001.ant.amazon.com (10.43.165.15) by EX13MTAUEA002.ant.amazon.com (10.43.61.77) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 17 Dec 2019 16:09:05 +0000 Received: from u886c93fd17d25d.ant.amazon.com (10.43.161.179) by EX13D31EUA001.ant.amazon.com (10.43.165.15) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 17 Dec 2019 16:09:00 +0000 From: SeongJae Park To: , , , Date: Tue, 17 Dec 2019 17:07:46 +0100 Message-ID: <20191217160748.693-5-sjpark@amazon.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20191217160748.693-1-sjpark@amazon.com> References: <20191217160748.693-1-sjpark@amazon.com> MIME-Version: 1.0 X-Originating-IP: [10.43.161.179] X-ClientProxiedBy: EX13d09UWC002.ant.amazon.com (10.43.162.102) To EX13D31EUA001.ant.amazon.com (10.43.165.15) Precedence: Bulk Subject: [Xen-devel] [PATCH v11 4/6] xen/blkback: Protect 'reclaim_memory()' with 'reclaim_lock' X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: linux-block@vger.kernel.org, sjpark@amazon.com, pdurrant@amazon.com, SeongJae Park , linux-kernel@vger.kernel.org, sj38.park@gmail.com, xen-devel@lists.xenproject.org Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" From: SeongJae Park The 'reclaim_memory()' callback of blkback could race with 'xen_blkbk_probe()' and 'xen_blkbk_remove()'. In the case, incompletely linked 'backend_info' and 'blkif' might be exposed to the callback, thus result in bad results including NULL dereference. This commit fixes the problem by applying the 'reclaim_lock' protection to those. Note that this commit is separated for review purpose only. As the previous commit might result in race condition and might make bisect confuse, please squash this commit into previous commit if possible. Signed-off-by: SeongJae Park --- drivers/block/xen-blkback/xenbus.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c index 4f6ea4feca79..20045827a391 100644 --- a/drivers/block/xen-blkback/xenbus.c +++ b/drivers/block/xen-blkback/xenbus.c @@ -492,6 +492,7 @@ static int xen_vbd_create(struct xen_blkif *blkif, blkif_vdev_t handle, static int xen_blkbk_remove(struct xenbus_device *dev) { struct backend_info *be = dev_get_drvdata(&dev->dev); + unsigned long flags; pr_debug("%s %p %d\n", __func__, dev, dev->otherend_id); @@ -504,6 +505,7 @@ static int xen_blkbk_remove(struct xenbus_device *dev) be->backend_watch.node = NULL; } + spin_lock_irqsave(&dev->reclaim_lock, flags); dev_set_drvdata(&dev->dev, NULL); if (be->blkif) { @@ -512,6 +514,7 @@ static int xen_blkbk_remove(struct xenbus_device *dev) /* Put the reference we set in xen_blkif_alloc(). */ xen_blkif_put(be->blkif); } + spin_unlock_irqrestore(&dev->reclaim_lock, flags); return 0; } @@ -597,6 +600,7 @@ static int xen_blkbk_probe(struct xenbus_device *dev, int err; struct backend_info *be = kzalloc(sizeof(struct backend_info), GFP_KERNEL); + unsigned long flags; /* match the pr_debug in xen_blkbk_remove */ pr_debug("%s %p %d\n", __func__, dev, dev->otherend_id); @@ -607,6 +611,7 @@ static int xen_blkbk_probe(struct xenbus_device *dev, return -ENOMEM; } be->dev = dev; + spin_lock_irqsave(&dev->reclaim_lock, flags); dev_set_drvdata(&dev->dev, be); be->blkif = xen_blkif_alloc(dev->otherend_id); @@ -614,8 +619,10 @@ static int xen_blkbk_probe(struct xenbus_device *dev, err = PTR_ERR(be->blkif); be->blkif = NULL; xenbus_dev_fatal(dev, err, "creating block interface"); + spin_unlock_irqrestore(&dev->reclaim_lock, flags); goto fail; } + spin_unlock_irqrestore(&dev->reclaim_lock, flags); err = xenbus_printf(XBT_NIL, dev->nodename, "feature-max-indirect-segments", "%u", @@ -838,6 +845,10 @@ static void reclaim_memory(struct xenbus_device *dev) { struct backend_info *be = dev_get_drvdata(&dev->dev); + /* Device is registered but not probed yet */ + if (!be) + return; + be->blkif->buffer_squeeze_end = jiffies + msecs_to_jiffies(buffer_squeeze_duration_ms); }