Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Jason Wang ca64edd7ae vhost_vdpa: assign irq bypass producer token correctly ... [ Upstream commit 02e9e9366f ] We used to call irq_bypass_unregister_producer() in vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the token pointer is still valid or not. Actually, we use the eventfd_ctx as the token so the life cycle of the token should be bound to the VHOST_SET_VRING_CALL instead of vhost_vdpa_setup_vq_irq() which could be called by set_status(). Fixing this by setting up irq bypass producer's token when handling VHOST_SET_VRING_CALL and un-registering the producer before calling vhost_vring_ioctl() to prevent a possible use after free as eventfd could have been released in vhost_vring_ioctl(). And such registering and unregistering will only be done if DRIVER_OK is set. Reported-by: Dragos Tatulea <dtatulea@nvidia.com> Tested-by: Dragos Tatulea <dtatulea@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Fixes: 2cf1ba9a4d ("vhost_vdpa: implement IRQ offloading in vhost_vdpa") Signed-off-by: Jason Wang <jasowang@redhat.com> Message-Id: <20240816031900.18013-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2024-10-04 16:29:40 +02:00
..
iotlb.c	vhost_iotlb: split out IOTLB initialization	2022-05-31 12:44:28 -04:00
Kconfig	vhost_task: Allow vhost layer to use copy_process	2023-03-23 12:45:36 +01:00
Makefile	vhost: introduce vDPA-based backend	2020-04-02 10:41:40 -04:00
net.c	vhost: convert poll work to be vq based	2023-07-03 12:15:13 -04:00
scsi.c	vhost-scsi: Handle vhost_vq_work_queue failures for events	2024-07-11 12:49:20 +02:00
test.c	vhost-test: remove meaningless debug info	2023-02-20 19:26:58 -05:00
test.h	tools/virtio: Add --reset	2020-06-22 12:34:21 -04:00
vdpa.c	vhost_vdpa: assign irq bypass producer token correctly	2024-10-04 16:29:40 +02:00
vhost.c	vhost_task: Handle SIGKILL by flushing work and exiting	2024-07-11 12:49:10 +02:00
vhost.h	vhost_task: Handle SIGKILL by flushing work and exiting	2024-07-11 12:49:10 +02:00
vringh.c	vringh: don't use vringh_kiov_advance() in vringh_iov_xfer()	2023-10-04 08:26:48 +01:00
vsock.c	vhost/vsock: always initialize seqpacket_allow	2024-08-03 08:54:01 +02:00