Received: by 10.192.165.148 with SMTP id m20csp568187imm; Fri, 20 Apr 2018 11:20:53 -0700 (PDT) X-Google-Smtp-Source: AIpwx48O8B91uMvLWP213Xoiz1zVG4LXWvRBWwbLCMk4KNpgQ/QGjjoCwIiEcMzw6JONSmWHK84k X-Received: by 2002:a17:902:b604:: with SMTP id b4-v6mr11361217pls.109.1524248453365; Fri, 20 Apr 2018 11:20:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524248453; cv=none; d=google.com; s=arc-20160816; b=jAn1CfGbntFyrG9bSSp/hOXGkglt5Uce6eugZutHlsElCtRt5WfJiFwIx98V5AHTYM mJGerdeSOpWdSAZvqF5+PfRuvs8Xy1NkHTAgmM7PtH07yIbD4TKkXSl95CEDykEq2f97 EOdRgABNvtcS40kBSfu3IrLpv6RvorZKaHYIvQvM5Q040lTHkyKmi2p2vfVrM0lyT+MC wIbCCRPVhJjhh1V8dWswetTYQSXwcqdKo+2QRNX6wtP5Eqkx/NRYN99IQRd7hmQQYFud Zx7jjL7zvdnqCEOWguY2oKN6lB4Hne2iGoiaznn4UWnFtN1SgtrhlMr9QQMXdqtTlD3b JpnA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-disposition:mime-version :message-id:subject:cc:to:from:date:arc-authentication-results; bh=3GJOBwssU2ZgUP/I5mNH5zZoeQkVvjP5sbral87B+AI=; b=aQmH7EYUVTfXek1KYcta+0kuPW70IgMwadxAtRnNYP6V0f8sJoS1/MJjpfR2SiBgrF oJkK8ubuOfregHFrf5bt8CJw0zlG4fwmVWmhgz+/rF8TP4LLjN8AlMfnSRW/VAHd+SIz vYuyfPbrKrYLW9pcpa8gE5P/iJzq1ePyY9u/KfU9ADdfaWtcvgM0xFn1Cf1WrQnWQd1x R1PVKQ0i8fk4pkLiOS552AszmsWX1xm1NaISaeg2ETO0Hitz5oGLFPxtBhMcf4aZzsfW z5AGTS1ziL7JFSomSFJXt9oWSPl34ReUJWQ3ADCb79/FKoc78cBlS5GpAzmlezW2KWMf JKmQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l15si1957914pgu.659.2018.04.20.11.20.39; Fri, 20 Apr 2018 11:20:53 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753716AbeDTSSD (ORCPT + 99 others); Fri, 20 Apr 2018 14:18:03 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:59658 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753514AbeDTSSB (ORCPT ); Fri, 20 Apr 2018 14:18:01 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4D4784072458; Fri, 20 Apr 2018 18:18:01 +0000 (UTC) Received: from redhat.com (ovpn-126-37.rdu2.redhat.com [10.10.126.37]) by smtp.corp.redhat.com (Postfix) with SMTP id 3EC8194582; Fri, 20 Apr 2018 18:18:00 +0000 (UTC) Date: Fri, 20 Apr 2018 21:18:00 +0300 From: "Michael S. Tsirkin" To: linux-kernel@vger.kernel.org Cc: Amit Shah , Arnd Bergmann , Greg Kroah-Hartman , virtualization@lists.linux-foundation.org, stable@vger.kernel.org, Tiwei Bie , Jason Wang Subject: [PATCH 0/6] virtio-console: spec compliance fixes Message-ID: <1524248223-393618-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Mutt-Fcc: =sent X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.5]); Fri, 20 Apr 2018 18:18:01 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.5]); Fri, 20 Apr 2018 18:18:01 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'mst@redhat.com' RCPT:'' Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Turns out virtio console tries to take a buffer out of an active vq. Works by sheer luck, and is explicitly forbidden by spec. And while going over it I saw that error handling is also broken - failure is easy to trigger if I force allocations to fail. Lightly tested. Michael S. Tsirkin (6): virtio_console: don't tie bufs to a vq virtio: add ability to iterate over vqs virtio_console: free buffers after reset virtio_console: drop custom control queue cleanup virtio_console: move removal code virtio_console: reset on out of memory drivers/char/virtio_console.c | 155 ++++++++++++++++++++---------------------- include/linux/virtio.h | 3 + 2 files changed, 75 insertions(+), 83 deletions(-) -- MST