[Devel] [PATCH hci-8.1 1/2] Revert "drivers/vhost: add ioctl to increase the number of workers"

[Alexander Ivanov]

This reverts commit 1491588e71dafc934c8d450ba36cc33bb0f990bd.

VHOST_SET_NWORKERS was a stopgap to run our userspace on the rh10
kernel unchanged. Userspace should use the mainstream worker ioctls
(VHOST_NEW_WORKER, VHOST_ATTACH_VRING_WORKER etc.) instead.

It is also unsafe next to those ioctls. vhost_set_workers() installs
its workers into vq->worker bypassing __vhost_vq_attach_worker(), so
their attachment_cnt stays 0. VHOST_FREE_WORKER then destroys such a
worker while a virtqueue still points at it, and the next
vhost_vq_work_queue() on that vq is a use-after-free. vhost-scsi
exposes this to the device owner.

The 0x1F ioctl number is freed: VHOST_SET_NWORKERS now fails with
-ENOTTY, so userspace that still issues it has to be updated
together with this kernel.

https://virtuozzo.atlassian.net/browse/VSTOR-107537
Feature: vhost-blk: in-kernel accelerator for virtio-blk guests

Signed-off-by: Alexander Ivanov <alexander.ivanov at virtuozzo.com>
---
 drivers/vhost/vhost.c      | 52 +-------------------------------------
 drivers/vhost/vhost.h      |  1 -
 include/uapi/linux/vhost.h |  8 ------
 3 files changed, 1 insertion(+), 60 deletions(-)

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 1057ba7e3fc7..56c0ecbb8352 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -605,8 +605,6 @@ void vhost_dev_init(struct vhost_dev *dev,
 	spin_lock_init(&dev->iotlb_lock);
 	xa_init_flags(&dev->worker_xa, XA_FLAGS_ALLOC);
 
-	dev->workers_set = false;
-
 	for (i = 0; i < dev->nvqs; ++i) {
 		vq = dev->vqs[i];
 		vq->log = NULL;
@@ -1089,42 +1087,6 @@ long vhost_worker_ioctl(struct vhost_dev *dev, unsigned int ioctl,
 }
 EXPORT_SYMBOL_GPL(vhost_worker_ioctl);
 
-static void vhost_propagate_workers(struct vhost_dev *dev, int nworkers)
-{
-	int i, j = 0;
-
-	for (i = nworkers; i < dev->nvqs; i++) {
-		dev->vqs[i]->worker = dev->vqs[j]->worker;
-		if (++j >= nworkers)
-			j = 0;
-	}
-}
-
-
-static int vhost_set_workers(struct vhost_dev *dev, int n)
-{
-	struct vhost_worker *worker;
-	int i, ret = 0;
-
-	if (n > dev->nvqs)
-		n = dev->nvqs;
-
-	dev->workers_set = true;
-
-	for (i = 1; i < n; i++) {
-		worker = vhost_worker_create(dev);
-		if (!worker) {
-			ret = -ENOMEM;
-			break;
-		}
-		dev->vqs[i]->worker = worker;
-	}
-
-	vhost_propagate_workers(dev, i);
-
-	return ret;
-}
-
 /* Caller should have device mutex */
 long vhost_dev_set_owner(struct vhost_dev *dev)
 {
@@ -1259,7 +1221,6 @@ void vhost_dev_cleanup(struct vhost_dev *dev)
 	wake_up_interruptible_poll(&dev->wait, EPOLLIN | EPOLLRDNORM);
 	vhost_workers_free(dev);
 	vhost_detach_mm(dev);
-	dev->workers_set = false;
 }
 EXPORT_SYMBOL_GPL(vhost_dev_cleanup);
 
@@ -2345,7 +2306,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
 	struct eventfd_ctx *ctx;
 	u64 p;
 	long r;
-	int i, fd, n;
+	int i, fd;
 
 	/* If you are not the owner, you can become one */
 	if (ioctl == VHOST_SET_OWNER) {
@@ -2441,17 +2402,6 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
 		if (ctx)
 			eventfd_ctx_put(ctx);
 		break;
-	case VHOST_SET_NWORKERS:
-		r = get_user(n, (int __user *)argp);
-		if (r < 0)
-			break;
-		if (d->workers_set) {
-			r = -EINVAL;
-			break;
-		}
-
-		r = vhost_set_workers(d, n);
-		break;
 	default:
 		r = -ENOIOCTLCMD;
 		break;
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 37ade2f1cb7d..077fa4d0cf36 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -198,7 +198,6 @@ struct vhost_dev {
 	 * The default value is set by fork_from_owner_default
 	 */
 	bool fork_owner;
-	bool workers_set;
 	int (*msg_handler)(struct vhost_dev *dev, u32 asid,
 			   struct vhost_iotlb_msg *msg);
 };
diff --git a/include/uapi/linux/vhost.h b/include/uapi/linux/vhost.h
index 5553522fbf48..4371703948b9 100644
--- a/include/uapi/linux/vhost.h
+++ b/include/uapi/linux/vhost.h
@@ -102,14 +102,6 @@
 #define VHOST_GET_VRING_WORKER _IOWR(VHOST_VIRTIO, 0x16,		\
 				     struct vhost_vring_worker)
 
-/* Set number of vhost workers.
- * This can be done only once until reset.
- * All workers are freed upon reset.
- * If the value is too big it is silently truncated to the maximum number of
- * supported vhost workers
- */
-#define VHOST_SET_NWORKERS _IOW(VHOST_VIRTIO, 0x1F, int)
-
 /* The following ioctls use eventfd file descriptors to signal and poll
  * for events. */
 
-- 
2.53.0