kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/vhost
History
Mike Christie a284f09eff vhost: Fix crash during early vhost_transport_send_pkt calls 
If userspace does VHOST_VSOCK_SET_GUEST_CID before VHOST_SET_OWNER we
can race where:
1. thread0 calls vhost_transport_send_pkt -> vhost_work_queue
2. thread1 does VHOST_SET_OWNER which calls vhost_worker_create.
3. vhost_worker_create will set the dev->worker pointer before setting
the worker->vtsk pointer.
4. thread0's vhost_work_queue will see the dev->worker pointer is
set and try to call vhost_task_wake using not yet set worker->vtsk
pointer.
5. We then crash since vtsk is NULL.

Before commit 6e890c5d50 ("vhost: use vhost_tasks for worker
threads"), we only had the worker pointer so we could just check it to
see if VHOST_SET_OWNER has been done. After that commit we have the
vhost_worker and vhost_task pointer, so we can now hit the bug above.

This patch embeds the vhost_worker in the vhost_dev and moves the work
list initialization back to vhost_dev_init, so we can just check the
worker.vtsk pointer to check if VHOST_SET_OWNER has been done like
before.

Fixes: 6e890c5d50 ("vhost: use vhost_tasks for worker threads")
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Message-Id: <20230607192338.6041-2-michael.christie@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reported-by: syzbot+d0d442c22fa8db45ff0e@syzkaller.appspotmail.com
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
History 2023-06-08 15:43:09 -04:00
..
iotlb.c vhost_iotlb: split out IOTLB initialization 2022-05-31 12:44:28 -04:00
Kconfig vhost_task: Allow vhost layer to use copy_process 2023-03-23 12:45:36 +01:00
Makefile vhost: introduce vDPA-based backend 2020-04-02 10:41:40 -04:00
net.c vhost_net: revert upend_idx only on retriable error 2023-06-08 15:43:08 -04:00
scsi.c virtio,vhost,vdpa: features, fixes, cleanups 2023-04-27 17:05:34 -07:00
test.c vhost-test: remove meaningless debug info 2023-02-20 19:26:58 -05:00
test.h tools/virtio: Add --reset 2020-06-22 12:34:21 -04:00
vdpa.c vhost_vdpa: tell vqs about the negotiated 2023-06-08 15:43:08 -04:00
vhost.c vhost: Fix crash during early vhost_transport_send_pkt calls 2023-06-08 15:43:09 -04:00
vhost.h vhost: Fix crash during early vhost_transport_send_pkt calls 2023-06-08 15:43:09 -04:00
vringh.c vringh: support VA with iotlb 2023-04-21 03:02:33 -04:00
vsock.c vsock: support sockmap 2023-03-29 08:19:38 +01:00