path: root/drivers/char
diff options
authorAmit Shah <amit.shah@redhat.com>2013-03-29 16:30:08 +0530
committerRusty Russell <rusty@rustcorp.com.au>2013-03-30 14:25:46 +1030
commit9ba5c80b1aea8648a3efe5f22dc1f7cacdfbeeb8 (patch)
treecdb191b7987323a4e454c9033ba4e449483ad57d /drivers/char
parent165b1b8bbc17c9469b053bab78b11b7cbce6d161 (diff)
virtio: console: add locking around c_ovq operations
When multiple ovq operations are being performed (lots of open/close operations on virtio_console fds), the __send_control_msg() function can get confused without locking. A simple recipe to cause badness is: * create a QEMU VM with two virtio-serial ports * in the guest, do while true;do echo abc >/dev/vport0p1;done while true;do echo edf >/dev/vport0p2;done In one run, this caused a panic in __send_control_msg(). In another, I got virtio_console virtio0: control-o:id 0 is not a head! This also results repeated messages similar to these on the host: qemu-kvm: virtio-serial-bus: Unexpected port id 478762112 for device virtio-serial-bus.0 qemu-kvm: virtio-serial-bus: Unexpected port id 478762368 for device virtio-serial-bus.0 Reported-by: FuXiangChun <xfu@redhat.com> Signed-off-by: Amit Shah <amit.shah@redhat.com> Reviewed-by: Wanlong Gao <gaowanlong@cn.fujitsu.com> Reviewed-by: Asias He <asias@redhat.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Cc: stable@kernel.org
Diffstat (limited to 'drivers/char')
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 2dd9134faa2..ce5f3fc25d6 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -150,6 +150,7 @@ struct ports_device {
/* To protect the vq operations for the control channel */
spinlock_t c_ivq_lock;
+ spinlock_t c_ovq_lock;
/* The current config space is stored here */
struct virtio_console_config config;
@@ -569,11 +570,14 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
vq = portdev->c_ovq;
sg_init_one(sg, &cpkt, sizeof(cpkt));
+ spin_lock(&portdev->c_ovq_lock);
if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt, GFP_ATOMIC) == 0) {
while (!virtqueue_get_buf(vq, &len))
+ spin_unlock(&portdev->c_ovq_lock);
return 0;
@@ -1997,6 +2001,7 @@ static int virtcons_probe(struct virtio_device *vdev)
unsigned int nr_added_bufs;
+ spin_lock_init(&portdev->c_ovq_lock);
INIT_WORK(&portdev->control_work, &control_work_handler);
nr_added_bufs = fill_queue(portdev->c_ivq,