Commit 2448a299 authored by Halil Pasic's avatar Halil Pasic Committed by Michael S. Tsirkin

virtio/s390: avoid race on vcdev->config

Currently we have a race on vcdev->config in virtio_ccw_get_config() and
in virtio_ccw_set_config().

This normally does not cause problems, as these are usually infrequent
operations. However, for some devices writing to/reading from the config
space can be triggered through sysfs attributes. For these, userspace can
force the race by increasing the frequency.
Signed-off-by: default avatarHalil Pasic <pasic@linux.ibm.com>
Cc: stable@vger.kernel.org
Message-Id: <20180925121309.58524-2-pasic@linux.ibm.com>
Signed-off-by: default avatarCornelia Huck <cohuck@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent c38f57da
...@@ -828,6 +828,7 @@ static void virtio_ccw_get_config(struct virtio_device *vdev, ...@@ -828,6 +828,7 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
int ret; int ret;
struct ccw1 *ccw; struct ccw1 *ccw;
void *config_area; void *config_area;
unsigned long flags;
ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL); ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
if (!ccw) if (!ccw)
...@@ -846,11 +847,13 @@ static void virtio_ccw_get_config(struct virtio_device *vdev, ...@@ -846,11 +847,13 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
if (ret) if (ret)
goto out_free; goto out_free;
spin_lock_irqsave(&vcdev->lock, flags);
memcpy(vcdev->config, config_area, offset + len); memcpy(vcdev->config, config_area, offset + len);
if (buf)
memcpy(buf, &vcdev->config[offset], len);
if (vcdev->config_ready < offset + len) if (vcdev->config_ready < offset + len)
vcdev->config_ready = offset + len; vcdev->config_ready = offset + len;
spin_unlock_irqrestore(&vcdev->lock, flags);
if (buf)
memcpy(buf, config_area + offset, len);
out_free: out_free:
kfree(config_area); kfree(config_area);
...@@ -864,6 +867,7 @@ static void virtio_ccw_set_config(struct virtio_device *vdev, ...@@ -864,6 +867,7 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
struct virtio_ccw_device *vcdev = to_vc_device(vdev); struct virtio_ccw_device *vcdev = to_vc_device(vdev);
struct ccw1 *ccw; struct ccw1 *ccw;
void *config_area; void *config_area;
unsigned long flags;
ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL); ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
if (!ccw) if (!ccw)
...@@ -876,9 +880,11 @@ static void virtio_ccw_set_config(struct virtio_device *vdev, ...@@ -876,9 +880,11 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
/* Make sure we don't overwrite fields. */ /* Make sure we don't overwrite fields. */
if (vcdev->config_ready < offset) if (vcdev->config_ready < offset)
virtio_ccw_get_config(vdev, 0, NULL, offset); virtio_ccw_get_config(vdev, 0, NULL, offset);
spin_lock_irqsave(&vcdev->lock, flags);
memcpy(&vcdev->config[offset], buf, len); memcpy(&vcdev->config[offset], buf, len);
/* Write the config area to the host. */ /* Write the config area to the host. */
memcpy(config_area, vcdev->config, sizeof(vcdev->config)); memcpy(config_area, vcdev->config, sizeof(vcdev->config));
spin_unlock_irqrestore(&vcdev->lock, flags);
ccw->cmd_code = CCW_CMD_WRITE_CONF; ccw->cmd_code = CCW_CMD_WRITE_CONF;
ccw->flags = 0; ccw->flags = 0;
ccw->count = offset + len; ccw->count = offset + len;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment