similar to: [tip:core/rcu] drivers/vhost: Replace synchronize_rcu_bh() with synchronize_rcu()

vhost_zerocopy_callback accesses VQ right after it drops a ubuf reference. In theory, this could race with device removal which waits on the ubuf kref, and crash on use after free. Do all accesses within rcu read side critical section, and synchronize on release. Since callbacks are always invoked from bh, synchronize_rcu_bh seems enough and will help release complete a bit faster.

vhost_zerocopy_callback accesses VQ right after it drops a ubuf reference. In theory, this could race with device removal which waits on the ubuf kref, and crash on use after free. Do all accesses within rcu read side critical section, and synchronize on release. Since callbacks are always invoked from bh, synchronize_rcu_bh seems enough and will help release complete a bit faster.

vhost_zerocopy_callback accesses VQ right after it drops the last ubuf reference. In theory, this could race with device removal which waits on the ubuf kref, and crash on use after free. Do all accesses within rcu read side critical section, and all synchronize on release. Since callbacks are always invoked from bh, synchronize_rcu_bh seems enough and will help release complete a bit faster.

This reverts commit ea5d404655ba3b356d0c06d6a3c4f24112124522. In commit 47283bef7ed356629467d1fac61687756e48f254(vhost: move memory pointer to VQs), rcu_ operation has been replaced by mutex, and original issue fixed in sea5d404655 has gone as well, we need to remove the no-longer-used `locked' var by reverting the orignal patch. Signed-off-by: Caspar Zhang <jinli.zjl at

This reverts commit ea5d404655ba ("vhost: fix release path lockdep checks") In commit 47283bef7ed3 ("vhost: move memory pointer to VQs"), RCU operations have been replaced by mutex, we need to remove the no longer used `locked' parameter by reverting original patch. Conflicts: drivers/vhost/net.c drivers/vhost/vhost.c drivers/vhost/vhost.h Signed-off-by: Caspar Zhang

This reverts commit ea5d404655ba3b356d0c06d6a3c4f24112124522. In commit 47283bef7ed356629467d1fac61687756e48f254(vhost: move memory pointer to VQs), rcu_ operation has been replaced by mutex, and original issue fixed in sea5d404655 has gone as well, we need to remove the no-longer-used `locked' var by reverting the orignal patch. Signed-off-by: Caspar Zhang <jinli.zjl at

This reverts commit ea5d404655ba ("vhost: fix release path lockdep checks") In commit 47283bef7ed3 ("vhost: move memory pointer to VQs"), RCU operations have been replaced by mutex, we need to remove the no longer used `locked' parameter by reverting original patch. Conflicts: drivers/vhost/net.c drivers/vhost/vhost.c drivers/vhost/vhost.h Signed-off-by: Caspar Zhang

In commit ea5d404655ba ("vhost: fix release path lockdep checks"), Michael added a flag to check whether we should hold a lock in vhost_dev_cleanup(), however, in commit 47283bef7ed3 ("vhost: move memory pointer to VQs"), RCU operations have been replaced by mutex, we can remove the no-longer-used `locked' parameter now. Signed-off-by: Caspar Zhang <jinli.zjl at

Commit-ID: 3a5db0b108e0a40f08c2bcff6a675dbf632b91e0 Gitweb: https://git.kernel.org/tip/3a5db0b108e0a40f08c2bcff6a675dbf632b91e0 Author: Paul E. McKenney <paulmck at linux.vnet.ibm.com> AuthorDate: Mon, 27 Nov 2017 09:45:10 -0800 Committer: Paul E. McKenney <paulmck at linux.vnet.ibm.com> CommitDate: Tue, 5 Dec 2017 11:57:55 -0800 drivers/vhost: Remove now-redundant

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration, bug work-arounds

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration, bug work-arounds

P_STREAM can get more than 4GMb/s for the receive side, and more than 5GMb/= s for the send side. Is it the result from the raw socket or through tap? I want to duplicate such performance with vhost on my side. I can only get = more than 1GMb/s with following conditions: 1) disabled the GRO feature in the host 10G NIC driver 2) vi->big_packet in guest is false 3) MTU is 1500. 4) raw socket, not

P_STREAM can get more than 4GMb/s for the receive side, and more than 5GMb/= s for the send side. Is it the result from the raw socket or through tap? I want to duplicate such performance with vhost on my side. I can only get = more than 1GMb/s with following conditions: 1) disabled the GRO feature in the host 10G NIC driver 2) vi->big_packet in guest is false 3) MTU is 1500. 4) raw socket, not

From: "Paul E. McKenney" <paulmck at linux.vnet.ibm.com> The sparse checking for rcu_assign_pointer() was recently upgraded to reject non-__kernel address spaces. This also rejects __rcu, which is almost always the right thing to do. However, the use in __br_mdb_del() is legitimate: They are assigning a pointer to an element from an RCU-protected list, and all elements of this

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration, bug work-arounds

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration, bug work-arounds

Device lock should be held when releasing a device, and specifically when calling vhost_dev_cleanup(). Otherwise, RCU complains about it: [ 2025.642835] =============================== [ 2025.643838] [ INFO: suspicious RCU usage. ] [ 2025.645182] ------------------------------- [ 2025.645927] drivers/vhost/vhost.c:475 suspicious rcu_dereference_protected() usage! [ 2025.647329] [ 2025.647330]

Device lock should be held when releasing a device, and specifically when calling vhost_dev_cleanup(). Otherwise, RCU complains about it: [ 2025.642835] =============================== [ 2025.643838] [ INFO: suspicious RCU usage. ] [ 2025.645182] ------------------------------- [ 2025.645927] drivers/vhost/vhost.c:475 suspicious rcu_dereference_protected() usage! [ 2025.647329] [ 2025.647330]

Sock will be NULL if we pass -1 to vhost_net_set_backend(), but when we meet errors during ubuf allocation, the code does not check for NULL before calling sockfd_put(), this will lead NULL dereferencing. Fixing by checking sock pointer before. Fixes: bab632d69ee4 ("vhost: vhost TX zero-copy support") Reported-by: Dan Carpenter <dan.carpenter at oracle.com> Signed-off-by: Jason

This fixes a deadlock with vhost reported in the field, as well as a theoretical race issue found by code review. Patches 1+2 are needed for stable. Thanks to Qin Chuanyu for reporting the issue! Michael S. Tsirkin (3): kref: add kref_sub_return vhost: fix ref cnt checking deadlock vhost: fix a theoretical race in device cleanup include/linux/kref.h | 33