kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/vhost
History
Jason Wang 927a258020 vhost_vdpa: assign irq bypass producer token correctly 
[ Upstream commit 02e9e9366f ]

We used to call irq_bypass_unregister_producer() in
vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the
token pointer is still valid or not.

Actually, we use the eventfd_ctx as the token so the life cycle of the
token should be bound to the VHOST_SET_VRING_CALL instead of
vhost_vdpa_setup_vq_irq() which could be called by set_status().

Fixing this by setting up irq bypass producer's token when handling
VHOST_SET_VRING_CALL and un-registering the producer before calling
vhost_vring_ioctl() to prevent a possible use after free as eventfd
could have been released in vhost_vring_ioctl(). And such registering
and unregistering will only be done if DRIVER_OK is set.

Reported-by: Dragos Tatulea <dtatulea@nvidia.com>
Tested-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Fixes: 2cf1ba9a4d ("vhost_vdpa: implement IRQ offloading in vhost_vdpa")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Message-Id: <20240816031900.18013-1-jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-10-17 15:11:06 +02:00
..
iotlb.c vhost: handle error while adding split ranges to iotlb 2022-04-08 14:24:12 +02:00
Kconfig vhost_vdpa: implement IRQ offloading in vhost_vdpa 2020-08-05 11:08:42 -04:00
Makefile vhost: introduce vDPA-based backend 2020-04-02 10:41:40 -04:00
net.c vhost_net: revert upend_idx only on retriable error 2023-06-28 10:29:53 +02:00
scsi.c vhost scsi: Convert to SPDX identifier 2021-09-05 16:23:08 -04:00
test.c tools/virtio: Add --reset 2020-06-22 12:34:21 -04:00
test.h tools/virtio: Add --reset 2020-06-22 12:34:21 -04:00
vdpa.c vhost_vdpa: assign irq bypass producer token correctly 2024-10-17 15:11:06 +02:00
vhost.c vhost: Add smp_rmb() in vhost_vq_avail_empty() 2024-04-17 11:15:16 +02:00
vhost.h vhost: support PACKED when setting-getting vring_base 2023-06-14 11:13:09 +02:00
vringh.c vringh: don't use vringh_kiov_advance() in vringh_iov_xfer() 2023-10-10 21:59:05 +02:00
vsock.c vhost/vsock: always initialize seqpacket_allow 2024-08-19 05:45:06 +02:00