similar to: [PATCH AUTOSEL 5.0 48/79] virtio_pci: fix a NULL pointer reference in vp_del_vqs

From: Longpeng <longpeng2 at huawei.com> [ Upstream commit 6a8aae68c87349dbbcd46eac380bc43cdb98a13b ] If the msix_affinity_masks is alloced failed, then we'll try to free some resources in vp_free_vectors() that may access it directly. We met the following stack in our production: [ 29.296767] BUG: unable to handle kernel NULL pointer dereference at (null) [ 29.311151] IP:

From: Longpeng <longpeng2 at huawei.com> [ Upstream commit 6a8aae68c87349dbbcd46eac380bc43cdb98a13b ] If the msix_affinity_masks is alloced failed, then we'll try to free some resources in vp_free_vectors() that may access it directly. We met the following stack in our production: [ 29.296767] BUG: unable to handle kernel NULL pointer dereference at (null) [ 29.311151] IP:

This lets IRQ layer handle dispatching IRQs to separate handlers for the case where we don't have per-VQ MSI-X vectors, and allows us to greatly simplify the code based on the assumption that we always have interrupt vector 0 (legacy INTx or config interrupt for MSI-X) available, and any other interrupt is request/freed throught the VQ, even if the actual interrupt line might be shared in some

This lets IRQ layer handle dispatching IRQs to separate handlers for the case where we don't have per-VQ MSI-X vectors, and allows us to greatly simplify the code based on the assumption that we always have interrupt vector 0 (legacy INTx or config interrupt for MSI-X) available, and any other interrupt is request/freed throught the VQ, even if the actual interrupt line might be shared in some

From: Markus Elfring <elfring at users.sourceforge.net> Date: Thu, 26 Jan 2017 22:10:18 +0100 A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus reuse the corresponding function "kcalloc". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring at

Try to grab the MSI-X vectors early and fall back to the shared one before doing lots of allocations. Signed-off-by: Christoph Hellwig <hch at lst.de> --- drivers/virtio/virtio_pci_common.c | 58 +++++++++++++++++++------------------- 1 file changed, 29 insertions(+), 29 deletions(-) diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c index

Signed-off-by: Christoph Hellwig <hch at lst.de> --- drivers/virtio/virtio_pci_common.c | 5 ++--- drivers/virtio/virtio_pci_common.h | 2 -- drivers/virtio/virtio_pci_legacy.c | 2 +- drivers/virtio/virtio_pci_modern.c | 2 +- include/uapi/linux/virtio_pci.h | 2 +- 5 files changed, 5 insertions(+), 8 deletions(-) diff --git a/drivers/virtio/virtio_pci_common.c

We don't really need struct virtio_pci_vq_info, as most field in there are redundant: - the vq backpointer is not strictly neede to start with - the entry in the vqs list is not needed - the generic virtqueue already has list, we only need to check if it has a callback to get the same semantics - we can use a simple array to look up the MSI-X vec if needed. - That simple array now

We don't really need struct virtio_pci_vq_info, as most field in there are redundant: - the vq backpointer is not strictly neede to start with - the entry in the vqs list is not needed - the generic virtqueue already has list, we only need to check if it has a callback to get the same semantics - we can use a simple array to look up the MSI-X vec if needed. - That simple array now

On Tue, Feb 07, 2017 at 03:17:02PM +0800, Jason Wang wrote: > The check is still there. Meh, I could swear I fixed it up. Here is an updated version: --- >From bf5e3b7fd272aea32388570503f00d0ab592fc2a Mon Sep 17 00:00:00 2001 From: Christoph Hellwig <hch at lst.de> Date: Wed, 25 Jan 2017 13:40:21 +0100 Subject: virtio_pci: remove struct virtio_pci_vq_info We don't really need

On Wed, Jun 19, 2013 at 07:59:48PM +0400, Andrew Vagin wrote: > vp_dev->msix_vectors should be initialized before allocating > msix_affinity_masks, otherwise vp_free_vectors will not free these > objects. > > unreferenced object 0xffff88010f969d88 (size 512): > comm "systemd-udevd", pid 158, jiffies 4294673645 (age 80.545s) > hex dump (first 32 bytes): >

On 06/20/2013 01:36 PM, Andrey Vagin wrote: > From: Andrew Vagin <avagin at openvz.org> > > vp_dev->msix_vectors should be initialized before allocating > msix_affinity_masks, otherwise vp_free_vectors will not free these > objects. > > unreferenced object 0xffff88010f969d88 (size 512): > comm "systemd-udevd", pid 158, jiffies 4294673645 (age 80.545s)

tree: https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git linux-next head: 4293ed1476ec42e45e54f812341058d812d820a5 commit: d5edad95c2f89cced19a23713f752442b620f0e1 [13/26] virtio: add context flag to find vqs config: x86_64-randconfig-x012-201714 (attached as .config) compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901 reproduce: git checkout

tree: https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git linux-next head: 4293ed1476ec42e45e54f812341058d812d820a5 commit: d5edad95c2f89cced19a23713f752442b620f0e1 [13/26] virtio: add context flag to find vqs config: x86_64-randconfig-x012-201714 (attached as .config) compiler: gcc-6 (Debian 6.2.0-3) 6.2.0 20160901 reproduce: git checkout

vp_dev->msix_vectors should be initialized before allocating msix_affinity_masks, otherwise vp_free_vectors will not free these objects. unreferenced object 0xffff88010f969d88 (size 512): comm "systemd-udevd", pid 158, jiffies 4294673645 (age 80.545s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00

vp_dev->msix_vectors should be initialized before allocating msix_affinity_masks, otherwise vp_free_vectors will not free these objects. unreferenced object 0xffff88010f969d88 (size 512): comm "systemd-udevd", pid 158, jiffies 4294673645 (age 80.545s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00

From: Andrew Vagin <avagin at openvz.org> vp_dev->msix_vectors should be initialized before allocating msix_affinity_masks, otherwise vp_free_vectors will not free these objects. unreferenced object 0xffff88010f969d88 (size 512): comm "systemd-udevd", pid 158, jiffies 4294673645 (age 80.545s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

From: Andrew Vagin <avagin at openvz.org> vp_dev->msix_vectors should be initialized before allocating msix_affinity_masks, otherwise vp_free_vectors will not free these objects. unreferenced object 0xffff88010f969d88 (size 512): comm "systemd-udevd", pid 158, jiffies 4294673645 (age 80.545s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

The cpumask vp_dev->msix_affinity_masks[info->msix_vector] may contain staled information when vp_set_vq_affinity() gets called, so clear it before setting the new cpu bit mask. Signed-off-by: Jiang Liu <jiang.liu at linux.intel.com> --- drivers/virtio/virtio_pci_common.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/virtio/virtio_pci_common.c

The cpumask vp_dev->msix_affinity_masks[info->msix_vector] may contain staled information when vp_set_vq_affinity() gets called, so clear it before setting the new cpu bit mask. Signed-off-by: Jiang Liu <jiang.liu at linux.intel.com> --- drivers/virtio/virtio_pci_common.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/virtio/virtio_pci_common.c