linux/drivers/vfio/pci
Alex Williamson 20f300175a vfio/pci: Fix racy vfio_device_get_from_dev() call
Testing the driver for a PCI device is racy, it can be all but
complete in the release path and still report the driver as ours.
Therefore we can't trust drvdata to be valid.  This race can sometimes
be seen when one port of a multifunction device is being unbound from
the vfio-pci driver while another function is being released by the
user and attempting a bus reset.  The device in the remove path is
found as a dependent device for the bus reset of the release path
device, the driver is still set to vfio-pci, but the drvdata has
already been cleared, resulting in a null pointer dereference.

To resolve this, fix vfio_device_get_from_dev() to not take the
dev_get_drvdata() shortcut and instead traverse through the
iommu_group, vfio_group, vfio_device path to get a reference we
can trust.  Once we have that reference, we know the device isn't
in transition and we can test to make sure the driver is still what
we expect, so that we don't interfere with devices we don't own.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2015-06-09 10:08:57 -06:00
..
Kconfig vfio: Split virqfd into a separate module for vfio bus drivers 2015-03-17 08:33:38 -06:00
Makefile vfio: initialize the virqfd workqueue in VFIO generic code 2015-03-16 14:08:54 -06:00
vfio_pci.c vfio/pci: Fix racy vfio_device_get_from_dev() call 2015-06-09 10:08:57 -06:00
vfio_pci_config.c vfio: make vfio run on s390 2014-11-07 09:52:22 -07:00
vfio_pci_intrs.c vfio: move eventfd support code for VFIO_PCI to a separate file 2015-03-16 14:08:54 -06:00
vfio_pci_private.h vfio: move eventfd support code for VFIO_PCI to a separate file 2015-03-16 14:08:54 -06:00
vfio_pci_rdwr.c