]> www.infradead.org Git - users/jedix/linux-maple.git/commit
vhost_vdpa: assign irq bypass producer token correctly
authorJason Wang <jasowang@redhat.com>
Fri, 16 Aug 2024 03:19:00 +0000 (11:19 +0800)
committerMichael S. Tsirkin <mst@redhat.com>
Tue, 10 Sep 2024 06:51:47 +0000 (02:51 -0400)
commit02e9e9366fefe461719da5d173385b6685f70319
treebb9f191d963c0ac04c455a430ee2d3edaea651ba
parentdc12502905b7a3de9097ea6b98870470c2921e09
vhost_vdpa: assign irq bypass producer token correctly

We used to call irq_bypass_unregister_producer() in
vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the
token pointer is still valid or not.

Actually, we use the eventfd_ctx as the token so the life cycle of the
token should be bound to the VHOST_SET_VRING_CALL instead of
vhost_vdpa_setup_vq_irq() which could be called by set_status().

Fixing this by setting up irq bypass producer's token when handling
VHOST_SET_VRING_CALL and un-registering the producer before calling
vhost_vring_ioctl() to prevent a possible use after free as eventfd
could have been released in vhost_vring_ioctl(). And such registering
and unregistering will only be done if DRIVER_OK is set.

Reported-by: Dragos Tatulea <dtatulea@nvidia.com>
Tested-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Fixes: 2cf1ba9a4d15 ("vhost_vdpa: implement IRQ offloading in vhost_vdpa")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Message-Id: <20240816031900.18013-1-jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
drivers/vhost/vdpa.c