Received: by 2002:a05:6a10:206:0:0:0:0 with SMTP id 6csp4616508pxj; Wed, 12 May 2021 09:18:51 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzStzeEfG5n1BS9G5Jluad+boy1JLFEN5nNn8mqkw+cEHj/sQAc9xvy2/GPWQ0Cl0Yx+zkD X-Received: by 2002:a17:906:170d:: with SMTP id c13mr37740225eje.491.1620836331250; Wed, 12 May 2021 09:18:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1620836331; cv=none; d=google.com; s=arc-20160816; b=vWs5tRPc7PmnyO31K/F8VaOgICEVabs90YbyHNUldvVnDD/niaHWNi7Puvyk94egLY XESxCkaVS7miYwaoEp2spznip5k5no58ULYYHLXo6ToiJPmZUMwas1AkOI7C+wRv6aU0 Hx67VMIC9HKUZM/IBaHByIedQ2nrBllNJGQJXl3QDrfBYItb13HM+r50oIG3cE/kvUQX oCs1Mgbu/7OO/sAalri1fPPNypFczw8PbdLMVqzN5KmhqrijwQ9ht8yxi7A+WsoCnuRD FE2RFOijRSKQFeTjPxcyRkuFKgnMX/zlLEaEBjJs9cXnT7cPgJKrDZYp0gIBxe5YaRfQ lHUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=H7IFjW1HCo22iNB4VyU7adGgrV7TOu3ALDEAq7Xk56E=; b=C5+eC8Dxqruf4ySL35kJtFc0WAO0Vf4jklmQHFHhEjHz8bE+09IcViXzu/xGCI/whz Syw2Fibc860hGcwWCRCNFzWQzhOr0+Jnbe4Oez9a4rwxk4w7Gw0HgMjOdXDc+g+IeJQt FQEB8k1dwAyr2QHBtjhy/soUWTiA2R/97poSW1qmbmQETSCv2dcxMA1tByr7Nw9Gt9km mXTVRlMaxzipVP+rUEDfmezq/YIsq58ZHxTBKF3p3pFufq6c+C4KXQJtkyEEgQcf3xQy RTJdCmRLpT40Bp0p8wrF2suLMvuIfs9/JwVKn0ZDSJ8iuYFztmQB+qHri26tKpHtRPZT IVMg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=iBKM4iSo; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id hx9si327153ejc.627.2021.05.12.09.18.27; Wed, 12 May 2021 09:18:51 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=iBKM4iSo; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239571AbhELQKH (ORCPT + 99 others); Wed, 12 May 2021 12:10:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:40914 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233830AbhELP3P (ORCPT ); Wed, 12 May 2021 11:29:15 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 5C3E361943; Wed, 12 May 2021 15:15:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1620832527; bh=tphvhTzPs2mQoPf0LroDP7r77qvJbG8SL36O/m5brLo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iBKM4iSoiJL3bEKxEB3FobTJH7V8/sbLZGxB+E6mrazCW7FCmIFjiBMuV+bWPF9Py 03F22raWMTZzjRLxB5CzL6h+w1JrkG+jODjkvgz9BtuRmZjGaZqKKHTVCDvXWDv07h uOzZNUU0G4o2lgN0/6v+82zbl4u06voxBYcSh6J8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jason Gunthorpe , Alex Williamson , Sasha Levin , Diana Craciun OSS Subject: [PATCH 5.10 316/530] vfio/fsl-mc: Re-order vfio_fsl_mc_probe() Date: Wed, 12 May 2021 16:47:06 +0200 Message-Id: <20210512144830.192793379@linuxfoundation.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210512144819.664462530@linuxfoundation.org> References: <20210512144819.664462530@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jason Gunthorpe [ Upstream commit 2b1fe162e584a88ec7f12a651a2a50f94dd8cfac ] vfio_add_group_dev() must be called only after all of the private data in vdev is fully setup and ready, otherwise there could be races with user space instantiating a device file descriptor and starting to call ops. For instance vfio_fsl_mc_reflck_attach() sets vdev->reflck and vfio_fsl_mc_open(), called by fops open, unconditionally derefs it, which will crash if things get out of order. This driver started life with the right sequence, but two commits added stuff after vfio_add_group_dev(). Fixes: 2e0d29561f59 ("vfio/fsl-mc: Add irq infrastructure for fsl-mc devices") Fixes: f2ba7e8c947b ("vfio/fsl-mc: Added lock support in preparation for interrupt handling") Co-developed-by: Diana Craciun OSS Signed-off-by: Jason Gunthorpe Message-Id: <5-v3-225de1400dfc+4e074-vfio1_jgg@nvidia.com> Signed-off-by: Alex Williamson Signed-off-by: Sasha Levin --- drivers/vfio/fsl-mc/vfio_fsl_mc.c | 74 ++++++++++++++++++++----------- 1 file changed, 47 insertions(+), 27 deletions(-) diff --git a/drivers/vfio/fsl-mc/vfio_fsl_mc.c b/drivers/vfio/fsl-mc/vfio_fsl_mc.c index f27e25112c40..8722f5effacd 100644 --- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c +++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c @@ -568,23 +568,39 @@ static int vfio_fsl_mc_init_device(struct vfio_fsl_mc_device *vdev) dev_err(&mc_dev->dev, "VFIO_FSL_MC: Failed to setup DPRC (%d)\n", ret); goto out_nc_unreg; } + return 0; + +out_nc_unreg: + bus_unregister_notifier(&fsl_mc_bus_type, &vdev->nb); + return ret; +} +static int vfio_fsl_mc_scan_container(struct fsl_mc_device *mc_dev) +{ + int ret; + + /* non dprc devices do not scan for other devices */ + if (!is_fsl_mc_bus_dprc(mc_dev)) + return 0; ret = dprc_scan_container(mc_dev, false); if (ret) { - dev_err(&mc_dev->dev, "VFIO_FSL_MC: Container scanning failed (%d)\n", ret); - goto out_dprc_cleanup; + dev_err(&mc_dev->dev, + "VFIO_FSL_MC: Container scanning failed (%d)\n", ret); + dprc_remove_devices(mc_dev, NULL, 0); + return ret; } - return 0; +} + +static void vfio_fsl_uninit_device(struct vfio_fsl_mc_device *vdev) +{ + struct fsl_mc_device *mc_dev = vdev->mc_dev; + + if (!is_fsl_mc_bus_dprc(mc_dev)) + return; -out_dprc_cleanup: - dprc_remove_devices(mc_dev, NULL, 0); dprc_cleanup(mc_dev); -out_nc_unreg: bus_unregister_notifier(&fsl_mc_bus_type, &vdev->nb); - vdev->nb.notifier_call = NULL; - - return ret; } static int vfio_fsl_mc_probe(struct fsl_mc_device *mc_dev) @@ -607,29 +623,39 @@ static int vfio_fsl_mc_probe(struct fsl_mc_device *mc_dev) } vdev->mc_dev = mc_dev; - - ret = vfio_add_group_dev(dev, &vfio_fsl_mc_ops, vdev); - if (ret) { - dev_err(dev, "VFIO_FSL_MC: Failed to add to vfio group\n"); - goto out_group_put; - } + mutex_init(&vdev->igate); ret = vfio_fsl_mc_reflck_attach(vdev); if (ret) - goto out_group_dev; + goto out_group_put; ret = vfio_fsl_mc_init_device(vdev); if (ret) goto out_reflck; - mutex_init(&vdev->igate); + ret = vfio_add_group_dev(dev, &vfio_fsl_mc_ops, vdev); + if (ret) { + dev_err(dev, "VFIO_FSL_MC: Failed to add to vfio group\n"); + goto out_device; + } + /* + * This triggers recursion into vfio_fsl_mc_probe() on another device + * and the vfio_fsl_mc_reflck_attach() must succeed, which relies on the + * vfio_add_group_dev() above. It has no impact on this vdev, so it is + * safe to be after the vfio device is made live. + */ + ret = vfio_fsl_mc_scan_container(mc_dev); + if (ret) + goto out_group_dev; return 0; -out_reflck: - vfio_fsl_mc_reflck_put(vdev->reflck); out_group_dev: vfio_del_group_dev(dev); +out_device: + vfio_fsl_uninit_device(vdev); +out_reflck: + vfio_fsl_mc_reflck_put(vdev->reflck); out_group_put: vfio_iommu_group_put(group, dev); return ret; @@ -646,16 +672,10 @@ static int vfio_fsl_mc_remove(struct fsl_mc_device *mc_dev) mutex_destroy(&vdev->igate); + dprc_remove_devices(mc_dev, NULL, 0); + vfio_fsl_uninit_device(vdev); vfio_fsl_mc_reflck_put(vdev->reflck); - if (is_fsl_mc_bus_dprc(mc_dev)) { - dprc_remove_devices(mc_dev, NULL, 0); - dprc_cleanup(mc_dev); - } - - if (vdev->nb.notifier_call) - bus_unregister_notifier(&fsl_mc_bus_type, &vdev->nb); - vfio_iommu_group_put(mc_dev->dev.iommu_group, dev); return 0; -- 2.30.2