Skip to content

Commit 2682d4e

Browse files
author
Alex Williamson
committed
vfio: Fix container device registration life cycle
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2155664 Conflicts: Semaphore vs mutex context since we don't yet include c82e81a ("vfio: Change vfio_group->group_rwsem to a mutex") commit 7fdba00 Author: Anthony DeRossi <ajderossi@gmail.com> Date: Wed Nov 9 17:40:25 2022 -0800 vfio: Fix container device registration life cycle In vfio_device_open(), vfio_device_container_register() is always called when open_count == 1. On error, vfio_device_container_unregister() is only called when open_count == 1 and close_device is set. This leaks a registration for devices without a close_device implementation. In vfio_device_fops_release(), vfio_device_container_unregister() is called unconditionally. This can cause a device to be unregistered multiple times. Treating container device registration/unregistration uniformly (always when open_count == 1) fixes both issues. Fixes: ce4b465 ("vfio: Replace the DMA unmapping notifier with a callback") Signed-off-by: Anthony DeRossi <ajderossi@gmail.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Reviewed-by: Yi Liu <yi.l.liu@intel.com> Link: https://lore.kernel.org/r/20221110014027.28780-2-ajderossi@gmail.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
1 parent 9a57ba0 commit 2682d4e

File tree

1 file changed

+8
-5
lines changed

1 file changed

+8
-5
lines changed

drivers/vfio/vfio_main.c

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1172,8 +1172,9 @@ static struct file *vfio_device_open(struct vfio_device *device)
11721172
err_close_device:
11731173
mutex_lock(&device->dev_set->lock);
11741174
down_read(&device->group->group_rwsem);
1175-
if (device->open_count == 1 && device->ops->close_device) {
1176-
device->ops->close_device(device);
1175+
if (device->open_count == 1) {
1176+
if (device->ops->close_device)
1177+
device->ops->close_device(device);
11771178

11781179
vfio_device_container_unregister(device);
11791180
}
@@ -1375,10 +1376,12 @@ static int vfio_device_fops_release(struct inode *inode, struct file *filep)
13751376
mutex_lock(&device->dev_set->lock);
13761377
vfio_assert_device_open(device);
13771378
down_read(&device->group->group_rwsem);
1378-
if (device->open_count == 1 && device->ops->close_device)
1379-
device->ops->close_device(device);
1379+
if (device->open_count == 1) {
1380+
if (device->ops->close_device)
1381+
device->ops->close_device(device);
13801382

1381-
vfio_device_container_unregister(device);
1383+
vfio_device_container_unregister(device);
1384+
}
13821385
up_read(&device->group->group_rwsem);
13831386
device->open_count--;
13841387
if (device->open_count == 0)

0 commit comments

Comments
 (0)