Commit dd54bcf8 authored by Nikolay Kuratov's avatar Nikolay Kuratov Committed by Michael S. Tsirkin
Browse files

vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() 



When operating on struct vhost_net_ubuf_ref, the following execution
sequence is theoretically possible:
CPU0 is finalizing DMA operation                   CPU1 is doing VHOST_NET_SET_BACKEND
                             // ubufs->refcount == 2
vhost_net_ubuf_put()                               vhost_net_ubuf_put_wait_and_free(oldubufs)
                                                     vhost_net_ubuf_put_and_wait()
                                                       vhost_net_ubuf_put()
                                                         int r = atomic_sub_return(1, &ubufs->refcount);
                                                         // r = 1
int r = atomic_sub_return(1, &ubufs->refcount);
// r = 0
                                                      wait_event(ubufs->wait, !atomic_read(&ubufs->refcount));
                                                      // no wait occurs here because condition is already true
                                                    kfree(ubufs);
if (unlikely(!r))
  wake_up(&ubufs->wait);  // use-after-free

This leads to use-after-free on ubufs access. This happens because CPU1
skips waiting for wake_up() when refcount is already zero.

To prevent that use a read-side RCU critical section in vhost_net_ubuf_put(),
as suggested by Hillf Danton. For this lock to take effect, free ubufs with
kfree_rcu().

Cc: stable@vger.kernel.org
Fixes: 0ad8b480 ("vhost: fix ref cnt checking deadlock")
Reported-by: default avatarAndrey Ryabinin <arbn@yandex-team.com>
Suggested-by: default avatarHillf Danton <hdanton@sina.com>
Signed-off-by: default avatarNikolay Kuratov <kniv@yandex-team.ru>
Message-Id: <20250805130917.727332-1-kniv@yandex-team.ru>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent a39d13e2

drivers/vhost/net.c

+7 −2
Original line number Diff line number Diff line
@@ -99,6 +99,7 @@ struct vhost_net_ubuf_ref { 
	atomic_t refcount;

	wait_queue_head_t wait;

	struct vhost_virtqueue *vq;

	struct rcu_head rcu;

};



#define VHOST_NET_BATCH 64
@@ -250,9 +251,13 @@ vhost_net_ubuf_alloc(struct vhost_virtqueue *vq, bool zcopy) 


static int vhost_net_ubuf_put(struct vhost_net_ubuf_ref *ubufs)

{

	int r = atomic_sub_return(1, &ubufs->refcount);

	int r;



	rcu_read_lock();

	r = atomic_sub_return(1, &ubufs->refcount);

	if (unlikely(!r))

		wake_up(&ubufs->wait);

	rcu_read_unlock();

	return r;

}
@@ -265,7 +270,7 @@ static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs) 
static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs)

{

	vhost_net_ubuf_put_and_wait(ubufs);

	kfree(ubufs);

	kfree_rcu(ubufs, rcu);

}



static void vhost_net_clear_ubuf_info(struct vhost_net *n)