search for: 78139c94dc8c

Commit 78139c94dc8c ("net: vhost: lock the vqs one by one") moved the vq lock to improve scalability, but introduced a possible deadlock in vhost-iotlb. vhost_iotlb_notify_vq() now takes vq->mutex while holding the device's IOTLB spinlock. And on the vhost_iotlb_miss() path, the spinlock is taken whil...

Commit 78139c94dc8c ("net: vhost: lock the vqs one by one") moved the vq lock to improve scalability, but introduced a possible deadlock in vhost-iotlb. vhost_iotlb_notify_vq() now takes vq->mutex while holding the device's IOTLB spinlock. And on the vhost_iotlb_miss() path, the spinlock is taken whil...

...18 at 05:44:52PM +0800, Jason Wang wrote: > When we try to do rx busy polling in tx path in commit 441abde4cd84 > ("net: vhost: add rx busy polling in tx path"), we lock rx vq mutex > after tx vq mutex is held. This may lead deadlock so we try to lock vq > one by one in commit 78139c94dc8c ("net: vhost: lock the vqs one by > one"). With this commit, we avoid the deadlock with the assumption > that handle_rx() and handle_tx() run in a same process. But this > commit remove the protection for IOTLB updating which requires the > mutex of each vq to be held. > &...

...18 at 05:44:52PM +0800, Jason Wang wrote: > When we try to do rx busy polling in tx path in commit 441abde4cd84 > ("net: vhost: add rx busy polling in tx path"), we lock rx vq mutex > after tx vq mutex is held. This may lead deadlock so we try to lock vq > one by one in commit 78139c94dc8c ("net: vhost: lock the vqs one by > one"). With this commit, we avoid the deadlock with the assumption > that handle_rx() and handle_tx() run in a same process. But this > commit remove the protection for IOTLB updating which requires the > mutex of each vq to be held. > &...

Commit 78139c94dc8c ("net: vhost: lock the vqs one by one") moved the vq lock to improve scalability, but introduced a possible deadlock in vhost-iotlb. vhost_iotlb_notify_vq() now takes vq->mutex while holding the device's IOTLB spinlock. And on the vhost_iotlb_miss() path, the spinlock is taken whil...

...: > > > When we try to do rx busy polling in tx path in commit 441abde4cd84 > > > ("net: vhost: add rx busy polling in tx path"), we lock rx vq mutex > > > after tx vq mutex is held. This may lead deadlock so we try to lock vq > > > one by one in commit 78139c94dc8c ("net: vhost: lock the vqs one by > > > one"). With this commit, we avoid the deadlock with the assumption > > > that handle_rx() and handle_tx() run in a same process. But this > > > commit remove the protection for IOTLB updating which requires the > > &...

...: > > > When we try to do rx busy polling in tx path in commit 441abde4cd84 > > > ("net: vhost: add rx busy polling in tx path"), we lock rx vq mutex > > > after tx vq mutex is held. This may lead deadlock so we try to lock vq > > > one by one in commit 78139c94dc8c ("net: vhost: lock the vqs one by > > > one"). With this commit, we avoid the deadlock with the assumption > > > that handle_rx() and handle_tx() run in a same process. But this > > > commit remove the protection for IOTLB updating which requires the > > &...

When we try to do rx busy polling in tx path in commit 441abde4cd84 ("net: vhost: add rx busy polling in tx path"), we lock rx vq mutex after tx vq mutex is held. This may lead deadlock so we try to lock vq one by one in commit 78139c94dc8c ("net: vhost: lock the vqs one by one"). With this commit, we avoid the deadlock with the assumption that handle_rx() and handle_tx() run in a same process. But this commit remove the protection for IOTLB updating which requires the mutex of each vq to be held. To solve this issue, the f...

...+0800, Jason Wang wrote: >> When we try to do rx busy polling in tx path in commit 441abde4cd84 >> ("net: vhost: add rx busy polling in tx path"), we lock rx vq mutex >> after tx vq mutex is held. This may lead deadlock so we try to lock vq >> one by one in commit 78139c94dc8c ("net: vhost: lock the vqs one by >> one"). With this commit, we avoid the deadlock with the assumption >> that handle_rx() and handle_tx() run in a same process. But this >> commit remove the protection for IOTLB updating which requires the >> mutex of each vq to...

...t;>> When we try to do rx busy polling in tx path in commit 441abde4cd84 >>>> ("net: vhost: add rx busy polling in tx path"), we lock rx vq mutex >>>> after tx vq mutex is held. This may lead deadlock so we try to lock vq >>>> one by one in commit 78139c94dc8c ("net: vhost: lock the vqs one by >>>> one"). With this commit, we avoid the deadlock with the assumption >>>> that handle_rx() and handle_tx() run in a same process. But this >>>> commit remove the protection for IOTLB updating which requires the >&...

On Fri, Nov 30, 2018 at 11:37:02AM +0000, Jean-Philippe Brucker wrote: > Commit 78139c94dc8c ("net: vhost: lock the vqs one by one") moved the vq > lock to improve scalability, but introduced a possible deadlock in > vhost-iotlb. vhost_iotlb_notify_vq() now takes vq->mutex while holding > the device's IOTLB spinlock. Indeed spin_lock is just outside this snippet....

On Wed, Dec 12, 2018 at 06:08:18PM +0800, Jason Wang wrote: > This reverts commit 78139c94dc8c96a478e67dab3bee84dc6eccb5fd. We don't > protect device IOTLB with vq mutex, which will lead e.g use after free > for device IOTLB entries. And since we've switched to use > mutex_trylock() in previous patch, it's safe to revert it without > having deadlock. > > Fixes:...

Hi: This series tries to fix various issues of vhost: - Patch 1 adds a missing write barrier between used idx updating and logging. - Patch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. - Patch 4 fixes the diry page logging when device IOTLB is enabled. We should done through GPA instead of GIOVA, this was done

Hi: This series tries to fix various issues of vhost: - Patch 1 adds a missing write barrier between used idx updating and logging. - Patch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. - Patch 4 fixes the diry page logging when device IOTLB is enabled. We should done through GPA instead of GIOVA, this was done

Hi: This series tries to fix various issues of vhost: - Patch 1 adds a missing write barrier between used idx updating and logging. - Patch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. Please consider them for -stable. Thanks Changes from V2: - drop dirty page fix and make it for net-next Changes from V1: -

Hi: This series tries to fix various issues of vhost: - Patch 1 adds a missing write barrier between used idx updating and logging. - Patch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. - Patch 4-7 fixes the diry page logging when device IOTLB is enabled. We should done through GPA instead of GIOVA, this was

Hi: This series tries to fix various issues of vhost: - Patch 1 adds a missing write barrier between used idx updating and logging. - Patch 2-3 brings back the protection of device IOTLB through vq mutex, this fixes possible use after free in device IOTLB entries. - Patch 4-7 fixes the diry page logging when device IOTLB is enabled. We should done through GPA instead of GIOVA, this was

...ring back the protection of device IOTLB with vq mutex that requires to hold mutex of all virtqueues at the same time. Fix this simply by switching to use mutex_trylock(), when fail just skip the busy polling. This can happen when device IOTLB is under updating which should be rare. Fixes: commit 78139c94dc8c ("net: vhost: lock the vqs one by one") Cc: Tonghao Zhang <xiangxia.m.yue at gmail.com> Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/ne...

This reverts commit 78139c94dc8c96a478e67dab3bee84dc6eccb5fd. We don't protect device IOTLB with vq mutex, which will lead e.g use after free for device IOTLB entries. And since we've switched to use mutex_trylock() in previous patch, it's safe to revert it without having deadlock. Fixes: commit 78139c94dc8c ("ne...