06 Jan, 2015

4 commits

  • The reason we defer kfree until release function is because it's a
    general rule for kobjects: kfree of the reference counter itself is only
    legal in the release function.

    Previous patch didn't make this clear, document this in code.

    Cc: stable@vger.kernel.org
    Signed-off-by: Michael S. Tsirkin

    Michael S. Tsirkin
     
  • A struct device which has just been unregistered can live on past the
    point at which a driver decides to drop it's initial reference to the
    kobject gained on allocation.

    This implies that when releasing a virtio device, we can't free a struct
    virtio_device until the underlying struct device has been released,
    which might not happen immediately on device_unregister().

    Unfortunately, this is exactly what virtio pci does:
    it has an empty release callback, and frees memory immediately
    after unregistering the device.

    This causes an easy to reproduce crash if CONFIG_DEBUG_KOBJECT_RELEASE
    it enabled.

    To fix, free the memory only once we know the device is gone in the release
    callback.

    Cc: stable@vger.kernel.org
    Signed-off-by: Sasha Levin
    Signed-off-by: Michael S. Tsirkin

    Sasha Levin
     
  • It turns out we need to add device-specific code
    in release callback. Move it to virtio_pci_legacy.c.

    Signed-off-by: Michael S. Tsirkin

    Michael S. Tsirkin
     
  • Our code calls del_vqs multiple times, assuming
    it's idempotent.

    commit 3ec7a77bb3089bb01032fdbd958eb5c29da58b49
    virtio_pci: free up vq->priv
    broke this assumption, by adding kfree there,
    so multiple calls cause double free.

    Fix it up.

    Fixes: 3ec7a77bb3089bb01032fdbd958eb5c29da58b49
    Reported-by: Sasha Levin
    Signed-off-by: Michael S. Tsirkin

    Michael S. Tsirkin
     

19 Dec, 2014

1 commit

  • Pull virtio fixes from Michael S Tsirkin:
    "virtio 1.0 related fixes

    Most importantly, this fixes using virtio_pci as a module.

    Further, the big virtio 1.0 conversion missed a couple of places.
    This fixes them up.

    This isn't 100% sparse-clean yet because on many architectures
    get_user triggers sparse warnings when used with __bitwise tag (when
    same tag is on both pointer and value read).

    I posted a patchset to fix it up by adding __force on all arches that
    don't already have it (many do), when that's merged these warnings
    will go away"

    * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
    virtio_pci: restore module attributes
    mic/host: fix up virtio 1.0 APIs
    vringh: update for virtio 1.0 APIs
    vringh: 64 bit features
    tools/virtio: add virtio 1.0 in vringh_test
    tools/virtio: add virtio 1.0 in virtio_test
    tools/virtio: enable -Werror
    tools/virtio: 64 bit features
    tools/virtio: fix vringh test
    tools/virtio: more stubs
    virtio: core support for config generation
    virtio_pci: add VIRTIO_PCI_NO_LEGACY
    virtio_pci: move probe to common file
    virtio_pci_common.h: drop VIRTIO_PCI_NO_LEGACY
    virtio_config: fix virtio_cread_bytes
    virtio: set VIRTIO_CONFIG_S_FEATURES_OK on restore

    Linus Torvalds
     

18 Dec, 2014

1 commit

  • Pull virtio updates from Rusty Russell:
    "A balloon enhancement, and a minor race-on-module-unload theoretical
    bug which doesn't merit cc: stable.

    All the exciting stuff went via MST this cycle"

    * tag 'virtio-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
    virtio_balloon: free some memory from balloon on OOM
    virtio_balloon: return the amount of freed memory from leak_balloon()
    virtio_blk: fix race at module removal
    virtio: Fix comment typo 'CONFIG_S_FAILED'

    Linus Torvalds
     

17 Dec, 2014

1 commit


15 Dec, 2014

1 commit

  • Pull driver core update from Greg KH:
    "Here's the set of driver core patches for 3.19-rc1.

    They are dominated by the removal of the .owner field in platform
    drivers. They touch a lot of files, but they are "simple" changes,
    just removing a line in a structure.

    Other than that, a few minor driver core and debugfs changes. There
    are some ath9k patches coming in through this tree that have been
    acked by the wireless maintainers as they relied on the debugfs
    changes.

    Everything has been in linux-next for a while"

    * tag 'driver-core-3.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (324 commits)
    Revert "ath: ath9k: use debugfs_create_devm_seqfile() helper for seq_file entries"
    fs: debugfs: add forward declaration for struct device type
    firmware class: Deletion of an unnecessary check before the function call "vunmap"
    firmware loader: fix hung task warning dump
    devcoredump: provide a one-way disable function
    device: Add dev__once variants
    ath: ath9k: use debugfs_create_devm_seqfile() helper for seq_file entries
    ath: use seq_file api for ath9k debugfs files
    debugfs: add helper function to create device related seq_file
    drivers/base: cacheinfo: remove noisy error boot message
    Revert "core: platform: add warning if driver has no owner"
    drivers: base: support cpu cache information interface to userspace via sysfs
    drivers: base: add cpu_device_create to support per-cpu devices
    topology: replace custom attribute macros with standard DEVICE_ATTR*
    cpumask: factor out show_cpumap into separate helper function
    driver core: Fix unbalanced device reference in drivers_probe
    driver core: fix race with userland in device_add()
    sysfs/kernfs: make read requests on pre-alloc files use the buffer.
    sysfs/kernfs: allow attributes to request write buffer be pre-allocated.
    fs: sysfs: return EGBIG on write if offset is larger than file size
    ...

    Linus Torvalds
     

14 Dec, 2014

1 commit


12 Dec, 2014

2 commits


10 Dec, 2014

12 commits


09 Dec, 2014

12 commits


11 Nov, 2014

2 commits

  • Excessive virtio_balloon inflation can cause invocation of OOM-killer,
    when Linux is under severe memory pressure. Various mechanisms are
    responsible for correct virtio_balloon memory management. Nevertheless
    it is often the case that these control tools does not have enough time
    to react on fast changing memory load. As a result OS runs out of memory
    and invokes OOM-killer. The balancing of memory by use of the virtio
    balloon should not cause the termination of processes while there are
    pages in the balloon. Now there is no way for virtio balloon driver to
    free some memory at the last moment before some process will be get
    killed by OOM-killer.

    This does not provide a security breach as balloon itself is running
    inside guest OS and is working in the cooperation with the host. Thus
    some improvements from guest side should be considered as normal.

    To solve the problem, introduce a virtio_balloon callback which is
    expected to be called from the oom notifier call chain in out_of_memory()
    function. If virtio balloon could release some memory, it will make
    the system to return and retry the allocation that forced the out of
    memory killer to run.

    Allocate virtio feature bit for this: it is not set by default,
    the the guest will not deflate virtio balloon on OOM without explicit
    permission from host.

    Signed-off-by: Raushaniya Maksudova
    Signed-off-by: Denis V. Lunev
    Acked-by: Michael S. Tsirkin
    Signed-off-by: Rusty Russell

    Raushaniya Maksudova
     
  • This value would be useful in the next patch to provide the amount of
    the freed memory for OOM killer.

    Signed-off-by: Raushaniya Maksudova
    Signed-off-by: Denis V. Lunev
    CC: Rusty Russell
    CC: Michael S. Tsirkin
    Signed-off-by: Rusty Russell

    Raushaniya Maksudova
     

20 Oct, 2014

1 commit


19 Oct, 2014

1 commit

  • Pull virtio updates from Rusty Russell:
    "One cc: stable commit, the rest are a series of minor cleanups which
    have been sitting in MST's tree during my vacation. I changed a
    function name and made one trivial change, then they spent two days in
    linux-next"

    * tag 'virtio-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: (25 commits)
    virtio-rng: refactor probe error handling
    virtio_scsi: drop scan callback
    virtio_balloon: enable VQs early on restore
    virtio_scsi: fix race on device removal
    virito_scsi: use freezable WQ for events
    virtio_net: enable VQs early on restore
    virtio_console: enable VQs early on restore
    virtio_scsi: enable VQs early on restore
    virtio_blk: enable VQs early on restore
    virtio_scsi: move kick event out from virtscsi_init
    virtio_net: fix use after free on allocation failure
    9p/trans_virtio: enable VQs early
    virtio_console: enable VQs early
    virtio_blk: enable VQs early
    virtio_net: enable VQs early
    virtio: add API to enable VQs early
    virtio_net: minor cleanup
    virtio-net: drop config_mutex
    virtio_net: drop config_enable
    virtio-blk: drop config_mutex
    ...

    Linus Torvalds
     

15 Oct, 2014

1 commit

  • virtio spec requires drivers to set DRIVER_OK before using VQs.
    This is set automatically after resume returns, virtio balloon
    violated this rule by adding bufs, which causes the VQ to be used
    directly within restore.

    To fix, call virtio_device_ready before using VQ.

    Signed-off-by: Michael S. Tsirkin
    Signed-off-by: Rusty Russell

    Michael S. Tsirkin