summaryrefslogtreecommitdiffstats
path: root/virt
diff options
context:
space:
mode:
authorHeyi Guo <guoheyi@huawei.com>2019-08-27 13:26:50 +0200
committerWill Deacon <will@kernel.org>2019-08-27 17:19:56 +0200
commitd4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44 (patch)
tree4445c51f62bbf92da124109b3700a8020fd6dab2 /virt
parentkallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the firs... (diff)
downloadlinux-d4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44.tar.xz
linux-d4a8061a7c5f7c27a2dc002ee4cb89b3e6637e44.zip
KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
If the ap_list is longer than 256 entries, merge_final() in list_sort() will call the comparison callback with the same element twice, causing a deadlock in vgic_irq_cmp(). Fix it by returning early when irqa == irqb. Cc: stable@vger.kernel.org # 4.7+ Fixes: 8e4447457965 ("KVM: arm/arm64: vgic-new: Add IRQ sorting") Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> Signed-off-by: Heyi Guo <guoheyi@huawei.com> [maz: massaged commit log and patch, added Fixes and Cc-stable] Signed-off-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
Diffstat (limited to 'virt')
-rw-r--r--virt/kvm/arm/vgic/vgic.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index 04786c8ec77e..ca5e6c6866a4 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -254,6 +254,13 @@ static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
bool penda, pendb;
int ret;
+ /*
+ * list_sort may call this function with the same element when
+ * the list is fairly long.
+ */
+ if (unlikely(irqa == irqb))
+ return 0;
+
raw_spin_lock(&irqa->irq_lock);
raw_spin_lock_nested(&irqb->irq_lock, SINGLE_DEPTH_NESTING);