mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

drm/virtio: Fix cache entry creation race. 

virtio_gpu_cmd_get_capset would check for the existence of an entry
under lock.  If it was not found, it would unlock and call
virtio_gpu_cmd_get_capset to create a new entry.  The new entry would
be added it to the list without checking if it was added by another
task during the period where the lock was not held resulting in
duplicate entries.

Compounding this issue, virtio_gpu_cmd_capset_cb would stop iterating
after find the first matching entry.  Multiple callbacks would modify
the first entry, but any subsequent entries and their associated waiters
would eventually timeout since they don't become valid, also wasting
memory along the way.

Signed-off-by: David Riley <davidriley@chromium.org>
Link: http://patchwork.freedesktop.org/patch/msgid/20190605234423.11348-3-davidriley@chromium.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
David Riley 2019-06-05 16:44:22 -07:00 committed by Gerd Hoffmann
parent 676a905b09
commit 5934ce998f
1 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/gpu/drm/virtio/virtgpu_vq.c
View File

@ -694,8 +694,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
struct virtio_gpu_vbuffer *vbuf;
int max_size;
struct virtio_gpu_drv_cap_cache *cache_ent;
struct virtio_gpu_drv_cap_cache *search_ent;
void *resp_buf;
*cache_p = NULL;
if (idx >= vgdev->num_capsets)
return -EINVAL;
@ -726,9 +729,26 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
atomic_set(&cache_ent->is_valid, 0);
cache_ent->size = max_size;
spin_lock(&vgdev->display_info_lock);
list_add_tail(&cache_ent->head, &vgdev->cap_cache);
/* Search while under lock in case it was added by another task. */
list_for_each_entry(search_ent, &vgdev->cap_cache, head) {
if (search_ent->id == vgdev->capsets[idx].id &&
search_ent->version == version) {
*cache_p = search_ent;
break;
}
}
if (!*cache_p)
list_add_tail(&cache_ent->head, &vgdev->cap_cache);
spin_unlock(&vgdev->display_info_lock);
if (*cache_p) {
/* Entry was found, so free everything that was just created. */
kfree(resp_buf);
kfree(cache_ent->caps_cache);
kfree(cache_ent);
return 0;
}
cmd_p = virtio_gpu_alloc_cmd_resp
(vgdev, &virtio_gpu_cmd_capset_cb, &vbuf, sizeof(*cmd_p),
sizeof(struct virtio_gpu_resp_capset) + max_size,