linux-toradex.git/drivers/virtio, branch v2.6.33.2

virtio: fix out of range array access

2010-04-01T23:01:21+00:00

commit 3119815912a220bdac943dfbdfee640414c0c611 upstream.

I have observed the following error on virtio-net module unload:

------------[ cut here ]------------
WARNING: at kernel/irq/manage.c:858 __free_irq+0xa0/0x14c()
Hardware name: Bochs
Trying to free already-free IRQ 0
Modules linked in: virtio_net(-) virtio_blk virtio_pci virtio_ring
virtio af_packet e1000 shpchp aacraid uhci_hcd ohci_hcd ehci_hcd [last
unloaded: scsi_wait_scan]
Pid: 1957, comm: rmmod Not tainted 2.6.33-rc8-vhost #24
Call Trace:
 [] warn_slowpath_common+0x7c/0x94
 [] warn_slowpath_fmt+0x41/0x43
 [] ? __free_pages+0x5a/0x70
 [] __free_irq+0xa0/0x14c
 [] free_irq+0x3f/0x65
 [] vp_del_vqs+0x81/0xb1 [virtio_pci]
 [] virtnet_remove+0xda/0x10b [virtio_net]
 [] virtio_dev_remove+0x22/0x4a [virtio]
 [] __device_release_driver+0x66/0xac
 [] driver_detach+0x83/0xa9
 [] bus_remove_driver+0x91/0xb4
 [] driver_unregister+0x6c/0x74
 [] unregister_virtio_driver+0xe/0x10 [virtio]
 [] fini+0x15/0x17 [virtio_net]
 [] sys_delete_module+0x1c3/0x230
 [] ? old_ich_force_enable_hpet+0x117/0x164
 [] ? do_page_fault+0x29c/0x2cc
 [] sysenter_dispatch+0x7/0x27
---[ end trace 15e88e4c576cc62b ]---

The bug is in virtio-pci: we use msix_vector as array index to get irq
entry, but some vqs do not have a dedicated vector so this causes an out
of bounds access.  By chance, we seem to often get 0 value, which
results in this error.

Fix by verifying that vector is legal before using it as index.

Signed-off-by: Michael S. Tsirkin 
Acked-by: Anthony Liguori 
Acked-by: Shirley Ma 
Acked-by: Amit Shah 
Signed-off-by: Greg Kroah-Hartman

virtio: fix section mismatch warnings

2010-01-16T20:15:39+00:00

Fix fixes the following warnings by renaming the driver structures to be
suffixed with _driver.

WARNING: drivers/virtio/virtio_balloon.o(.data+0x88): Section mismatch in reference from the variable virtio_balloon to the function .devexit.text:virtballoon_remove()

WARNING: drivers/char/hw_random/virtio-rng.o(.data+0x88): Section mismatch in reference from the variable virtio_rng to the function .devexit.text:virtrng_remove()

Signed-off-by: Jeff Mahoney 
Acked-by: Rusty Russell 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

virtio: order used ring after used index read

2009-10-28T22:20:37+00:00

On SMP guests, reads from the ring might bypass used index reads. This
causes guest crashes because host writes to used index to signal ring
data readiness.  Fix this by inserting rmb before used ring reads.

Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Rusty Russell 
Cc: stable@kernel.org

virtio-pci: fix per-vq MSI-X request logic

2009-10-28T22:20:36+00:00

Commit f68d24082e22ccee3077d11aeb6dc5354f0ca7f1
in 2.6.32-rc1 broke requesting IRQs for per-VQ MSI-X vectors:
- vector number was used instead of the vector itself
- we try to request an IRQ for VQ which does not
  have a callback handler

This is a regression that causes warnings in kernel log,
potentially lower performance as we need to scan vq list,
and might cause system failure if the interrupt
requested is in fact needed by another system.

This was not noticed earlier because in most cases
we were falling back on shared interrupt for all vqs.

The warnings often look like this:

virtio-pci 0000:00:03.0: irq 26 for MSI/MSI-X
virtio-pci 0000:00:03.0: irq 27 for MSI/MSI-X
virtio-pci 0000:00:03.0: irq 28 for MSI/MSI-X
IRQ handler type mismatch for IRQ 1
current handler: i8042
Pid: 2400, comm: modprobe Tainted: G        W
2.6.32-rc3-11952-gf3ed8d8-dirty #1
Call Trace:
 [] ? __setup_irq+0x299/0x304
 [] ? request_threaded_irq+0x144/0x1c1
 [] ? vring_interrupt+0x0/0x30
 [] ? vp_try_to_find_vqs+0x583/0x5c7
 [] ? skb_recv_done+0x0/0x34 [virtio_net]
 [] ? vp_find_vqs+0x2d/0x83
 [] ? vp_get+0x3c/0x4e
 [] ? virtnet_probe+0x2f1/0x428 [virtio_net]
 [] ? skb_recv_done+0x0/0x34 [virtio_net]
 [] ? skb_xmit_done+0x0/0x39 [virtio_net]
 [] ? sysfs_do_create_link+0xcb/0x116
 [] ? vp_get_status+0x14/0x16
 [] ? virtio_dev_probe+0xa9/0xc8
 [] ? driver_probe_device+0x8d/0x128
 [] ? __driver_attach+0x4f/0x6f
 [] ? __driver_attach+0x0/0x6f
 [] ? bus_for_each_dev+0x43/0x74
 [] ? bus_add_driver+0xea/0x22d
 [] ? driver_register+0xa7/0x111
 [] ? init+0x0/0xc [virtio_net]
 [] ? do_one_initcall+0x50/0x148
 [] ? sys_init_module+0xc5/0x21a
 [] ? system_call_fastpath+0x16/0x1b
virtio-pci 0000:00:03.0: irq 26 for MSI/MSI-X
virtio-pci 0000:00:03.0: irq 27 for MSI/MSI-X

Reported-by: Marcelo Tosatti 
Reported-by: Shirley Ma 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Rusty Russell

move virtballoon_remove to .devexit.text

2009-10-22T06:09:31+00:00

The function virtballoon_remove is used only wrapped by __devexit_p so
define it using __devexit.

Signed-off-by: Uwe Kleine-König 
Acked-by: Sam Ravnborg 
Acked-by: Michael S. Tsirkin 
Signed-off-by: Rusty Russell

virtio: let header files include virtio_ids.h

2009-10-22T06:09:28+00:00

Rusty,

commit 3ca4f5ca73057a617f9444a91022d7127041970a
    virtio: add virtio IDs file
moved all device IDs into a single file. While the change itself is
a very good one, it can break userspace applications. For example
if a userspace tool wanted to get the ID of virtio_net it used to
include virtio_net.h. This does no longer work, since virtio_net.h
does not include virtio_ids.h.
This patch moves all "#include " from the C
files into the header files, making the header files compatible with
the old ones.

In addition, this patch exports virtio_ids.h to userspace.

CC: Fernando Luis Vazquez Cao 
Signed-off-by: Christian Borntraeger 
Signed-off-by: Rusty Russell

virtio: add virtio IDs file

2009-09-23T12:56:32+00:00

Virtio IDs are spread all over the tree which makes assigning new IDs
bothersome. Putting them together should make the process less error-prone.

Signed-off-by: Fernando Luis Vazquez Cao 
Signed-off-by: Rusty Russell

virtio: make add_buf return capacity remaining

2009-09-23T12:56:31+00:00

This API change means that virtio_net can tell how much capacity
remains for buffers.  It's necessarily fuzzy, since
VIRTIO_RING_F_INDIRECT_DESC means we can fit any number of descriptors
in one, *if* we can kmalloc.

Signed-off-by: Rusty Russell 
Cc: Dinesh Subhraveti

virtio_pci: minor MSI-X cleanups

2009-09-23T12:56:31+00:00

1) Rename vp_request_vectors to vp_request_msix_vectors, and take
   non-MSI-X case out to caller.
2) Comment weird pci_enable_msix API
3) Rename vp_find_vq to setup_vq.
4) Fix spaces to tabs
5) Make nvectors calc internal to vp_try_to_find_vqs()
6) Rename vector to msix_vector for more clarity.

Signed-off-by: Rusty Russell 
Cc: "Michael S. Tsirkin"

virtio: refactor find_vqs

2009-07-30T06:33:45+00:00

This refactors find_vqs, making it more readable and robust, and fixing
two regressions from 2.6.30:
- double free_irq causing BUG_ON on device removal
- probe failure when vq can't be assigned to msi-x vector
  (reported on old host kernels)

Tested-by: Amit Shah 
Signed-off-by: Michael S. Tsirkin 
Signed-off-by: Rusty Russell