From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Yihuang Yu <yihyu@redhat.com>,
Will Deacon <will@kernel.org>, Gavin Shan <gshan@redhat.com>,
Jason Wang <jasowang@redhat.com>,
"Michael S. Tsirkin" <mst@redhat.com>,
Stefano Garzarella <sgarzare@redhat.com>,
stable@kernel.org
Subject: [PATCH 4.19 10/77] vhost: Add smp_rmb() in vhost_vq_avail_empty()
Date: Tue, 30 Apr 2024 12:38:49 +0200 [thread overview]
Message-ID: <20240430103041.425493448@linuxfoundation.org> (raw)
In-Reply-To: <20240430103041.111219002@linuxfoundation.org>
4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavin Shan <gshan@redhat.com>
commit 22e1992cf7b034db5325660e98c41ca5afa5f519 upstream.
A smp_rmb() has been missed in vhost_vq_avail_empty(), spotted by
Will. Otherwise, it's not ensured the available ring entries pushed
by guest can be observed by vhost in time, leading to stale available
ring entries fetched by vhost in vhost_get_vq_desc(), as reported by
Yihuang Yu on NVidia's grace-hopper (ARM64) platform.
/home/gavin/sandbox/qemu.main/build/qemu-system-aarch64 \
-accel kvm -machine virt,gic-version=host -cpu host \
-smp maxcpus=1,cpus=1,sockets=1,clusters=1,cores=1,threads=1 \
-m 4096M,slots=16,maxmem=64G \
-object memory-backend-ram,id=mem0,size=4096M \
: \
-netdev tap,id=vnet0,vhost=true \
-device virtio-net-pci,bus=pcie.8,netdev=vnet0,mac=52:54:00:f1:26:b0
:
guest# netperf -H 10.26.1.81 -l 60 -C -c -t UDP_STREAM
virtio_net virtio0: output.0:id 100 is not a head!
Add the missed smp_rmb() in vhost_vq_avail_empty(). When tx_can_batch()
returns true, it means there's still pending tx buffers. Since it might
read indices, so it still can bypass the smp_rmb() in vhost_get_vq_desc().
Note that it should be safe until vq->avail_idx is changed by commit
275bf960ac697 ("vhost: better detection of available buffers").
Fixes: 275bf960ac69 ("vhost: better detection of available buffers")
Cc: <stable@kernel.org> # v4.11+
Reported-by: Yihuang Yu <yihyu@redhat.com>
Suggested-by: Will Deacon <will@kernel.org>
Signed-off-by: Gavin Shan <gshan@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-Id: <20240328002149.1141302-2-gshan@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vhost/vhost.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -2426,9 +2426,19 @@ bool vhost_vq_avail_empty(struct vhost_d
r = vhost_get_avail(vq, avail_idx, &vq->avail->idx);
if (unlikely(r))
return false;
+
vq->avail_idx = vhost16_to_cpu(vq, avail_idx);
+ if (vq->avail_idx != vq->last_avail_idx) {
+ /* Since we have updated avail_idx, the following
+ * call to vhost_get_vq_desc() will read available
+ * ring entries. Make sure that read happens after
+ * the avail_idx read.
+ */
+ smp_rmb();
+ return false;
+ }
- return vq->avail_idx == vq->last_avail_idx;
+ return true;
}
EXPORT_SYMBOL_GPL(vhost_vq_avail_empty);
next prev parent reply other threads:[~2024-04-30 10:41 UTC|newest]
Thread overview: 86+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-30 10:38 [PATCH 4.19 00/77] 4.19.313-rc1 review Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 01/77] batman-adv: Avoid infinite loop trying to resize local TT Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 02/77] Bluetooth: Fix memory leak in hci_req_sync_complete() Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 03/77] nouveau: fix function cast warning Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 04/77] geneve: fix header validation in geneve[6]_xmit_skb Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 05/77] ipv6: fib: hide unused pn variable Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 06/77] ipv4/route: avoid unused-but-set-variable warning Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 07/77] ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 08/77] net/mlx5: Properly link new fs rules into the tree Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 09/77] tracing: hide unused ftrace_event_id_fops Greg Kroah-Hartman
2024-04-30 10:38 ` Greg Kroah-Hartman [this message]
2024-04-30 10:38 ` [PATCH 4.19 11/77] selftests: timers: Fix abs() warning in posix_timers test Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 12/77] x86/apic: Force native_apic_mem_read() to use the MOV instruction Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 13/77] btrfs: record delayed inode root in transaction Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 14/77] selftests/ftrace: Limit length in subsystem-enable tests Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 15/77] kprobes: Fix possible use-after-free issue on kprobe registration Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 16/77] Revert "tracing/trigger: Fix to return error if failed to alloc snapshot" Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 17/77] netfilter: nf_tables: __nft_expr_type_get() selects specific family type Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 18/77] netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 19/77] tun: limit printing rate when illegal packet received by tun dev Greg Kroah-Hartman
2024-04-30 10:38 ` [PATCH 4.19 20/77] RDMA/mlx5: Fix port number for counter query in multi-port configuration Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 21/77] drm: nv04: Fix out of bounds access Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 22/77] comedi: vmk80xx: fix incomplete endpoint checking Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 23/77] serial/pmac_zilog: Remove flawed mitigation for rx irq flood Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 24/77] USB: serial: option: add Fibocom FM135-GL variants Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 25/77] USB: serial: option: add support for Fibocom FM650/FG650 Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 26/77] USB: serial: option: add Lonsung U8300/U9300 product Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 27/77] USB: serial: option: support Quectel EM060K sub-models Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 28/77] USB: serial: option: add Rolling RW101-GL and RW135-GL support Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 29/77] USB: serial: option: add Telit FN920C04 rmnet compositions Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 30/77] Revert "usb: cdc-wdm: close race between read and workqueue" Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 31/77] usb: dwc2: host: Fix dereference issue in DDMA completion flow Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 32/77] speakup: Avoid crash on very long word Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 33/77] fs: sysfs: Fix reference leak in sysfs_break_active_protection() Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 34/77] nouveau: fix instmem race condition around ptr stores Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 35/77] nilfs2: fix OOB in nilfs_set_de_type Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 36/77] tracing: Remove hist trigger synth_var_refs Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 37/77] tracing: Use var_refs[] for hist trigger reference checking Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 38/77] arm64: dts: rockchip: fix alphabetical ordering RK3399 puma Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 39/77] arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 40/77] arm64: dts: mediatek: mt7622: fix IR nodename Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 41/77] arm64: dts: mediatek: mt7622: fix ethernet controller "compatible" Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 42/77] arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 43/77] ARC: [plat-hsdk]: Remove misplaced interrupt-cells property Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 44/77] vxlan: drop packets from invalid src-address Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 45/77] mlxsw: core: Unregister EMAD trap using FORWARD action Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 46/77] NFC: trf7970a: disable all regulators on removal Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 47/77] net: usb: ax88179_178a: stop lying about skb->truesize Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 48/77] net: gtp: Fix Use-After-Free in gtp_dellink Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 49/77] ipvs: Fix checksumming on GSO of SCTP packets Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 50/77] net: openvswitch: ovs_ct_exit to be done under ovs_lock Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 51/77] net: openvswitch: Fix Use-After-Free in ovs_ct_exit Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 52/77] i40e: Do not use WQ_MEM_RECLAIM flag for workqueue Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 53/77] serial: core: Provide port lock wrappers Greg Kroah-Hartman
2024-04-30 10:50 ` John Ogness
2024-04-30 12:10 ` John Ogness
2024-04-30 12:40 ` Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 54/77] serial: mxs-auart: add spinlock around changing cts state Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 55/77] drm/amdgpu: restrict bo mapping within gpu address limits Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 56/77] amdgpu: validate offset_in_bo of drm_amdgpu_gem_va Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 57/77] drm/amdgpu: validate the parameters of bo mapping operations more clearly Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 58/77] Revert "crypto: api - Disallow identical driver names" Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 59/77] tracing: Show size of requested perf buffer Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 60/77] tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 61/77] Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 62/77] btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 63/77] arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 64/77] irqchip/gic-v3-its: Prevent double free on error Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 65/77] net: b44: set pause params only when interface is up Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 66/77] stackdepot: respect __GFP_NOLOCKDEP allocation flag Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 67/77] mtd: diskonchip: work around ubsan link failure Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 68/77] tcp: Clean up kernel listeners reqsk in inet_twsk_purge() Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 69/77] tcp: Fix NEW_SYN_RECV handling " Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 70/77] dmaengine: owl: fix register access functions Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 71/77] idma64: Dont try to serve interrupts when device is powered off Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 72/77] i2c: smbus: fix NULL function pointer dereference Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 73/77] HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 74/77] Revert "loop: Remove sector_t truncation checks" Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 75/77] Revert "y2038: rusage: use __kernel_old_timeval" Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 76/77] udp: preserve the connected status if only UDP cmsg Greg Kroah-Hartman
2024-04-30 10:39 ` [PATCH 4.19 77/77] serial: core: fix kernel-doc for uart_port_unlock_irqrestore() Greg Kroah-Hartman
2024-05-01 13:37 ` [PATCH 4.19 00/77] 4.19.313-rc1 review Jon Hunter
2024-05-01 19:44 ` Pavel Machek
2024-05-02 3:13 ` Shuah Khan
2024-05-02 7:49 ` Naresh Kamboju
2024-05-02 8:31 ` Harshit Mogalapalli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240430103041.425493448@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=gshan@redhat.com \
--cc=jasowang@redhat.com \
--cc=mst@redhat.com \
--cc=patches@lists.linux.dev \
--cc=sgarzare@redhat.com \
--cc=stable@kernel.org \
--cc=stable@vger.kernel.org \
--cc=will@kernel.org \
--cc=yihyu@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).