The commit is pushed to "branch-rh9-5.14.0-362.8.1.vz9.35.x-ovz" and will
appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh9-5.14.0-362.8.1.vz9.35.7
------>
commit 17ad03ac78b94dc1fcdf3a76758a43b4efc439ee
Author: Pavel Tikhomirov <ptikhomi...@virtuozzo.com>
Date: Mon Jan 22 14:54:21 2024 +0800
drivers/vhost: fix missing rcu_read_lock in vhost_work_queue
In this stack:
+-> vhost_vsock_dev_ioctl
+-> vhost_vsock_start
+-> vhost_work_queue
+-> xas_find
+-> xas_load
+-> xas_start
+-> xa_head
+-> rcu_dereference_check
We require either rcu_read_lock or xa_lock but have none. Let's fix it
by calling a xa_find, which is a wraper for xas_find having proper rcu
and also xas_retry logic.
https://virtuozzo.atlassian.net/browse/PSBM-153264
Fixes: 5271bf51f1b83 ("ms/vhost: replace single worker pointer with xarray")
Signed-off-by: Pavel Tikhomirov <ptikhomi...@virtuozzo.com>
Feature: vhost-blk: in-kernel accelerator for virtio-blk guests
---
drivers/vhost/vhost.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index c32557e279df..2f45c8d2b6fd 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -257,10 +257,10 @@ static bool vhost_worker_queue(struct vhost_worker
*worker,
bool vhost_work_queue(struct vhost_dev *dev, struct vhost_work *work)
{
- XA_STATE(xas, &dev->worker_xa, 0);
struct vhost_worker *worker;
+ unsigned long i;
- worker = xas_find(&xas, UINT_MAX);
+ worker = xa_find(&dev->worker_xa, &i, ULONG_MAX, XA_PRESENT);
if (!worker)
return false;
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
