From 7d2dddda5c928f349a01f1d5ca8ee5e9d4283c7a Mon Sep 17 00:00:00 2001 From: Jingoo Han Date: Tue, 3 Dec 2013 06:44:01 +1030 Subject: [PATCH 1/3] virtio: pci: remove unnecessary pci_set_drvdata() The driver core clears the driver data to NULL after device_release or on probe failure. Thus, it is not needed to manually clear the device driver data to NULL. Signed-off-by: Jingoo Han Signed-off-by: Rusty Russell --- drivers/virtio/virtio_pci.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c index a37c69941d30..a416f9b2a7f6 100644 --- a/drivers/virtio/virtio_pci.c +++ b/drivers/virtio/virtio_pci.c @@ -742,7 +742,6 @@ static int virtio_pci_probe(struct pci_dev *pci_dev, return 0; out_set_drvdata: - pci_set_drvdata(pci_dev, NULL); pci_iounmap(pci_dev, vp_dev->ioaddr); out_req_regions: pci_release_regions(pci_dev); @@ -760,7 +759,6 @@ static void virtio_pci_remove(struct pci_dev *pci_dev) unregister_virtio_device(&vp_dev->vdev); vp_del_vqs(&vp_dev->vdev); - pci_set_drvdata(pci_dev, NULL); pci_iounmap(pci_dev, vp_dev->ioaddr); pci_release_regions(pci_dev); pci_disable_device(pci_dev); From f466f75385369a181409e46da272db3de6f5c5cb Mon Sep 17 00:00:00 2001 From: Asias He Date: Thu, 16 Jan 2014 10:18:48 +1030 Subject: [PATCH 2/3] virtio-scsi: Fix hotcpu_notifier use-after-free with virtscsi_freeze vqs are freed in virtscsi_freeze but the hotcpu_notifier is not unregistered. We will have a use-after-free usage when the notifier callback is called after virtscsi_freeze. Fixes: 285e71ea6f3583a85e27cb2b9a7d8c35d4c0d558 ("virtio-scsi: reset virtqueue affinity when doing cpu hotplug") Cc: stable@vger.kernel.org Signed-off-by: Asias He Reviewed-by: Paolo Bonzini Signed-off-by: Jason Wang Signed-off-by: Rusty Russell --- drivers/scsi/virtio_scsi.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c index c3173dced870..16bfd50cd3fe 100644 --- a/drivers/scsi/virtio_scsi.c +++ b/drivers/scsi/virtio_scsi.c @@ -956,6 +956,10 @@ static void virtscsi_remove(struct virtio_device *vdev) #ifdef CONFIG_PM_SLEEP static int virtscsi_freeze(struct virtio_device *vdev) { + struct Scsi_Host *sh = virtio_scsi_host(vdev); + struct virtio_scsi *vscsi = shost_priv(sh); + + unregister_hotcpu_notifier(&vscsi->nb); virtscsi_remove_vqs(vdev); return 0; } @@ -964,8 +968,17 @@ static int virtscsi_restore(struct virtio_device *vdev) { struct Scsi_Host *sh = virtio_scsi_host(vdev); struct virtio_scsi *vscsi = shost_priv(sh); + int err; - return virtscsi_init(vdev, vscsi); + err = virtscsi_init(vdev, vscsi); + if (err) + return err; + + err = register_hotcpu_notifier(&vscsi->nb); + if (err) + vdev->config->del_vqs(vdev); + + return err; } #endif From 05c54de8c88c02bd0a44de8316d5e276b856632e Mon Sep 17 00:00:00 2001 From: Rashika Kheria Date: Thu, 16 Jan 2014 10:18:48 +1030 Subject: [PATCH 3/3] drivers: virtio: Mark function virtballoon_migratepage() as static in virtio_balloon.c MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mark the function virtballoon_migratepage() as static in virtio_balloon.c because it is not used outside this file. This eliminates the following warning in virtio_balloon.c: drivers/virtio/virtio_balloon.c:372:5: warning: no previous prototype for ‘virtballoon_migratepage’ [-Wmissing-prototypes] Signed-off-by: Rashika Kheria Reviewed-by: Josh Triplett Acked-by: Michael S. Tsirkin Signed-off-by: Rusty Russell --- drivers/virtio/virtio_balloon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c index c444654fc33f..8c5943de9fd0 100644 --- a/drivers/virtio/virtio_balloon.c +++ b/drivers/virtio/virtio_balloon.c @@ -369,7 +369,7 @@ static const struct address_space_operations virtio_balloon_aops; * This function preforms the balloon page migration task. * Called through balloon_mapping->a_ops->migratepage */ -int virtballoon_migratepage(struct address_space *mapping, +static int virtballoon_migratepage(struct address_space *mapping, struct page *newpage, struct page *page, enum migrate_mode mode) { struct balloon_dev_info *vb_dev_info = balloon_page_device(page);