From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754383AbdERARB (ORCPT ); Wed, 17 May 2017 20:17:01 -0400 Received: from a2nlsmtp01-03.prod.iad2.secureserver.net ([198.71.225.37]:60484 "EHLO a2nlsmtp01-03.prod.iad2.secureserver.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753626AbdERARA (ORCPT ); Wed, 17 May 2017 20:17:00 -0400 x-originating-ip: 107.180.71.197 From: mikelley@exchange.microsoft.com To: gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, devel@linuxdriverproject.org, olaf@aepfle.de, apw@canonical.com, vkuznets@redhat.com, jasowang@redhat.com, leann.ogasawara@canonical.com, marcelo.cerri@canonical.com, sthemmin@microsoft.com, kys@microsoft.com Cc: Michael Kelley Subject: [PATCH v2 1/1] Drivers: hv: vmbus: Close timing hole that can corrupt per-cpu page Date: Wed, 17 May 2017 17:15:18 -0700 Message-Id: <1495066518-21607-1-git-send-email-mikelley@exchange.microsoft.com> X-Mailer: git-send-email 1.7.1 Reply-To: mikelley@microsoft.com X-CMAE-Envelope: MS4wfL7F9JmaVq2WYUKFqtA/EW+jEBWdjb4290MxH4uGIhzgmct5mqxdQxulIEJVeyTQFvXVSlrYHyTJ7YFWf4QAW9mAB9vT058o1H4THsiiAOcuoD3pujeO lTH20s/6jDm+qhzVHvzYoZXrPCFzsJxoNZzHsCAw0vu9NGSYsNvEvWP4s6yMvqhvO2xt60mVKEuPknWVxO5Wet/AMjSs8Td7xVirSgk0Vxh2oc4lBzOA+El+ bR/vx+Mpd5jCycE2V63+4OMGufPpTtELybzG5UbX3bHrsGbRMyi4ijpYVRIdb9GkW/PswsUmX1JPaU281U49Bvz4+xXRDgKDWnuUzzKLYrXnwXqo6qLkYZ+j dnJVAvcwiSUdUvimU92sI5CesXTuk/4fIi95PdFSnH4gxkAKGinqtL5TqQ9ViUNZYcuqqZvqgOzHMiKM3bOHxh4KmxC/ojgvyUeCFZQGZJiGBLmDRBhsHvux FkihyrYaAmH4IJCxTkPNy7F1Rm8YvQATZMk30z9bbI7lhE2LoWu7Lv9EkTeEFU5Xff1Uoeoy1VeA/jAsDZ8hdsgA2U9t8oEoNABeag== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michael Kelley Extend the disabling of preemption to include the hypercall so that another thread can't get the CPU and corrupt the per-cpu page used for hypercall arguments. Signed-off-by: Michael Kelley --- drivers/hv/hv.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c index 12e7bae..47ed538 100644 --- a/drivers/hv/hv.c +++ b/drivers/hv/hv.c @@ -82,9 +82,14 @@ int hv_post_message(union hv_connection_id connection_id, aligned_msg->message_type = message_type; aligned_msg->payload_size = payload_size; memcpy((void *)aligned_msg->payload, payload, payload_size); - put_cpu_ptr(hv_cpu); status = hv_do_hypercall(HVCALL_POST_MESSAGE, aligned_msg, NULL); + + /* Preemption must remain disabled until after the hypercall + * so some other thread can't get scheduled onto this cpu and + * corrupt the per-cpu post_msg_page + */ + put_cpu_ptr(hv_cpu); return status & 0xFFFF; } -- 1.7.1