Commit 670e8864 authored by Alex Williamson's avatar Alex Williamson Committed by Alex Williamson
Browse files

vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex 



vfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the
vdev->cdx_irqs array based on its value, but provides no serialization
against concurrent VFIO_DEVICE_SET_IRQS ioctls.  Two callers can race
such that one observes config_msi as set while another clears it and
frees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free
of the cdx_irqs array.

Add a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in
vfio_cdx_set_msi_trigger(), which is the single chokepoint through
which all updates to config_msi, cdx_irqs, and msi_count flow, covering
both the ioctl path and the close-device cleanup path.  This keeps the
test of config_msi atomic with the subsequent enable, disable, or
trigger operations.

Drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part
of this change: the optimization it provided is redundant with the
!config_msi early-return inside vfio_cdx_msi_disable(), and leaving the
test in place would be an unsynchronized read of state the new lock is
meant to protect.

Fixes: 848e447e ("vfio/cdx: add interrupt support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: default avatarAlex Williamson <alex.williamson@nvidia.com>
Acked-by: default avatarNikhil Agarwal <nikhil.agarwal@amd.com>
Link: https://lore.kernel.org/r/20260417202800.88287-3-alex.williamson@nvidia.com


Signed-off-by: default avatarAlex Williamson <alex@shazbot.org>
parent 5ea58807

drivers/vfio/cdx/intr.c

+2 −7
Original line number Diff line number Diff line
@@ -152,6 +152,8 @@ static int vfio_cdx_set_msi_trigger(struct vfio_cdx_device *vdev, 
	if (start + count > cdx_dev->num_msi)

		return -EINVAL;



	guard(mutex)(&vdev->cdx_irqs_lock);



	if (!count && (flags & VFIO_IRQ_SET_DATA_NONE)) {

		vfio_cdx_msi_disable(vdev);

		return 0;
@@ -210,12 +212,5 @@ int vfio_cdx_set_irqs_ioctl(struct vfio_cdx_device *vdev, 
/* Free All IRQs for the given device */

void vfio_cdx_irqs_cleanup(struct vfio_cdx_device *vdev)

{

	/*

	 * Device does not support any interrupt or the interrupts

	 * were not configured

	 */

	if (!vdev->cdx_irqs)

		return;



	vfio_cdx_set_msi_trigger(vdev, 0, 0, 0, VFIO_IRQ_SET_DATA_NONE, NULL);

}

drivers/vfio/cdx/main.c

+19 −0
Original line number Diff line number Diff line
@@ -8,6 +8,23 @@ 


#include "private.h"



static int vfio_cdx_init_dev(struct vfio_device *core_vdev)

{

	struct vfio_cdx_device *vdev =

		container_of(core_vdev, struct vfio_cdx_device, vdev);



	mutex_init(&vdev->cdx_irqs_lock);

	return 0;

}



static void vfio_cdx_release_dev(struct vfio_device *core_vdev)

{

	struct vfio_cdx_device *vdev =

		container_of(core_vdev, struct vfio_cdx_device, vdev);



	mutex_destroy(&vdev->cdx_irqs_lock);

}



static int vfio_cdx_open_device(struct vfio_device *core_vdev)

{

	struct vfio_cdx_device *vdev =
@@ -273,6 +290,8 @@ static int vfio_cdx_mmap(struct vfio_device *core_vdev, 


static const struct vfio_device_ops vfio_cdx_ops = {

	.name		= "vfio-cdx",

	.init		= vfio_cdx_init_dev,

	.release	= vfio_cdx_release_dev,

	.open_device	= vfio_cdx_open_device,

	.close_device	= vfio_cdx_close_device,

	.ioctl		= vfio_cdx_ioctl,

drivers/vfio/cdx/private.h

+3 −0
Original line number Diff line number Diff line
@@ -6,6 +6,8 @@ 
#ifndef VFIO_CDX_PRIVATE_H

#define VFIO_CDX_PRIVATE_H



#include <linux/mutex.h>



#define VFIO_CDX_OFFSET_SHIFT    40



static inline u64 vfio_cdx_index_to_offset(u32 index)
@@ -31,6 +33,7 @@ struct vfio_cdx_region { 
struct vfio_cdx_device {

	struct vfio_device	vdev;

	struct vfio_cdx_region	*regions;

	struct mutex		cdx_irqs_lock;

	struct vfio_cdx_irq	*cdx_irqs;

	u32			flags;

#define BME_SUPPORT BIT(0)