From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752396AbdFNMbs (ORCPT ); Wed, 14 Jun 2017 08:31:48 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34430 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752372AbdFNMbq (ORCPT ); Wed, 14 Jun 2017 08:31:46 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 34243C04B320 Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=eric.auger@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 34243C04B320 Subject: Re: [PATCH 1/7] vfio: Fix group release deadlock To: Alex Williamson , kvm@vger.kernel.org References: <20170609215816.31986.89321.stgit@gimli.home> <20170609215934.31986.87512.stgit@gimli.home> Cc: linux-kernel@vger.kernel.org From: Auger Eric Message-ID: <152e466a-ab00-60ee-7ebf-05ed79272d80@redhat.com> Date: Wed, 14 Jun 2017 14:31:41 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 In-Reply-To: <20170609215934.31986.87512.stgit@gimli.home> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Wed, 14 Jun 2017 12:31:46 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Alex, On 09/06/2017 23:59, Alex Williamson wrote: > If vfio_iommu_group_notifier() acquires a group reference and that > reference becomes the last reference to the group, then vfio_group_put > introduces a deadlock code path where we're trying to unregister from > the iommu notifier chain from within a callout of that chain. Use a > work_struct to release this reference asynchronously. > > Signed-off-by: Alex Williamson > --- > drivers/vfio/vfio.c | 37 ++++++++++++++++++++++++++++++++++++- > 1 file changed, 36 insertions(+), 1 deletion(-) > > diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c > index 561084ab387f..f2e24d5699f2 100644 > --- a/drivers/vfio/vfio.c > +++ b/drivers/vfio/vfio.c > @@ -423,6 +423,34 @@ static void vfio_group_put(struct vfio_group *group) > kref_put_mutex(&group->kref, vfio_group_release, &vfio.group_lock); > } > > +struct vfio_group_put_work { > + struct work_struct work; > + struct vfio_group *group; > +}; > + > +static void vfio_group_put_bg(struct work_struct *work) > +{ > + struct vfio_group_put_work *do_work; > + > + do_work = container_of(work, struct vfio_group_put_work, work); > + > + vfio_group_put(do_work->group); > + kfree(do_work); > +} > + > +static void vfio_group_schedule_put(struct vfio_group *group) > +{ > + struct vfio_group_put_work *do_work; > + > + do_work = kmalloc(sizeof(*do_work), GFP_KERNEL); > + if (WARN_ON(!do_work)) > + return; > + > + INIT_WORK(&do_work->work, vfio_group_put_bg); > + do_work->group = group; > + schedule_work(&do_work->work); > +} > + > /* Assume group_lock or group reference is held */ > static void vfio_group_get(struct vfio_group *group) > { > @@ -762,7 +790,14 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb, > break; > } > > - vfio_group_put(group); > + /* > + * If we're the last reference to the group, the group will be > + * released, which includes unregistering the iommu group notifier. > + * We hold a read-lock on that notifier list, unregistering needs > + * a write-lock... deadlock. Release our reference asyncronously nit: s/asyncronously/asynchronously Reviewed-by: Eric Auger Thanks Eric > + * to avoid that situation. > + */ > + vfio_group_schedule_put(group); > return NOTIFY_OK; > } > >