releases/6.1.87/vhost-add-smp_rmb-in-vhost_enable_notify.patch

   1 From df9ace7647d4123209395bb9967e998d5758c645 Mon Sep 17 00:00:00 2001
   2 From: Gavin Shan <gshan@redhat.com>
   3 Date: Thu, 28 Mar 2024 10:21:48 +1000
   4 Subject: vhost: Add smp_rmb() in vhost_enable_notify()
   5
   6 From: Gavin Shan <gshan@redhat.com>
   7
   8 commit df9ace7647d4123209395bb9967e998d5758c645 upstream.
   9
  10 A smp_rmb() has been missed in vhost_enable_notify(), inspired by
  11 Will. Otherwise, it's not ensured the available ring entries pushed
  12 by guest can be observed by vhost in time, leading to stale available
  13 ring entries fetched by vhost in vhost_get_vq_desc(), as reported by
  14 Yihuang Yu on NVidia's grace-hopper (ARM64) platform.
  15
  16   /home/gavin/sandbox/qemu.main/build/qemu-system-aarch64      \
  17   -accel kvm -machine virt,gic-version=host -cpu host          \
  18   -smp maxcpus=1,cpus=1,sockets=1,clusters=1,cores=1,threads=1 \
  19   -m 4096M,slots=16,maxmem=64G                                 \
  20   -object memory-backend-ram,id=mem0,size=4096M                \
  21    :                                                           \
  22   -netdev tap,id=vnet0,vhost=true                              \
  23   -device virtio-net-pci,bus=pcie.8,netdev=vnet0,mac=52:54:00:f1:26:b0
  24    :
  25   guest# netperf -H 10.26.1.81 -l 60 -C -c -t UDP_STREAM
  26   virtio_net virtio0: output.0:id 100 is not a head!
  27
  28 Add the missed smp_rmb() in vhost_enable_notify(). When it returns true,
  29 it means there's still pending tx buffers. Since it might read indices,
  30 so it still can bypass the smp_rmb() in vhost_get_vq_desc(). Note that
  31 it should be safe until vq->avail_idx is changed by commit d3bb267bbdcb
  32 ("vhost: cache avail index in vhost_enable_notify()").
  33
  34 Fixes: d3bb267bbdcb ("vhost: cache avail index in vhost_enable_notify()")
  35 Cc: <stable@kernel.org> # v5.18+
  36 Reported-by: Yihuang Yu <yihyu@redhat.com>
  37 Suggested-by: Will Deacon <will@kernel.org>
  38 Signed-off-by: Gavin Shan <gshan@redhat.com>
  39 Acked-by: Jason Wang <jasowang@redhat.com>
  40 Message-Id: <20240328002149.1141302-3-gshan@redhat.com>
  41 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
  42 Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
  43 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  44 ---
  45  drivers/vhost/vhost.c |   12 +++++++++++-
  46  1 file changed, 11 insertions(+), 1 deletion(-)
  47
  48 --- a/drivers/vhost/vhost.c
  49 +++ b/drivers/vhost/vhost.c
  50 @@ -2572,9 +2572,19 @@ bool vhost_enable_notify(struct vhost_de
  51                        &vq->avail->idx, r);
  52                 return false;
  53         }
  54 +
  55         vq->avail_idx = vhost16_to_cpu(vq, avail_idx);
  56 +       if (vq->avail_idx != vq->last_avail_idx) {
  57 +               /* Since we have updated avail_idx, the following
  58 +                * call to vhost_get_vq_desc() will read available
  59 +                * ring entries. Make sure that read happens after
  60 +                * the avail_idx read.
  61 +                */
  62 +               smp_rmb();
  63 +               return true;
  64 +       }
  65
  66 -       return vq->avail_idx != vq->last_avail_idx;
  67 +       return false;
  68  }
  69  EXPORT_SYMBOL_GPL(vhost_enable_notify);
  70