Patch "vhost_vdpa: assign irq bypass producer token correctly" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    vhost_vdpa: assign irq bypass producer token correctly

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     vhost_vdpa-assign-irq-bypass-producer-token-correctl.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3650229c7f793d0d72e9c22dbb406ca0bda80050
Author: Jason Wang <jasowang@xxxxxxxxxx>
Date:   Fri Aug 16 11:19:00 2024 +0800

    vhost_vdpa: assign irq bypass producer token correctly
    
    [ Upstream commit 02e9e9366fefe461719da5d173385b6685f70319 ]
    
    We used to call irq_bypass_unregister_producer() in
    vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the
    token pointer is still valid or not.
    
    Actually, we use the eventfd_ctx as the token so the life cycle of the
    token should be bound to the VHOST_SET_VRING_CALL instead of
    vhost_vdpa_setup_vq_irq() which could be called by set_status().
    
    Fixing this by setting up irq bypass producer's token when handling
    VHOST_SET_VRING_CALL and un-registering the producer before calling
    vhost_vring_ioctl() to prevent a possible use after free as eventfd
    could have been released in vhost_vring_ioctl(). And such registering
    and unregistering will only be done if DRIVER_OK is set.
    
    Reported-by: Dragos Tatulea <dtatulea@xxxxxxxxxx>
    Tested-by: Dragos Tatulea <dtatulea@xxxxxxxxxx>
    Reviewed-by: Dragos Tatulea <dtatulea@xxxxxxxxxx>
    Fixes: 2cf1ba9a4d15 ("vhost_vdpa: implement IRQ offloading in vhost_vdpa")
    Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx>
    Message-Id: <20240816031900.18013-1-jasowang@xxxxxxxxxx>
    Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index ef9e845a5a5c5..59587f9880d3c 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -191,11 +191,9 @@ static void vhost_vdpa_setup_vq_irq(struct vhost_vdpa *v, u16 qid)
 	if (irq < 0)
 		return;
 
-	irq_bypass_unregister_producer(&vq->call_ctx.producer);
 	if (!vq->call_ctx.ctx)
 		return;
 
-	vq->call_ctx.producer.token = vq->call_ctx.ctx;
 	vq->call_ctx.producer.irq = irq;
 	ret = irq_bypass_register_producer(&vq->call_ctx.producer);
 	if (unlikely(ret))
@@ -571,6 +569,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
 			vq->last_avail_idx = vq_state.split.avail_index;
 		}
 		break;
+	case VHOST_SET_VRING_CALL:
+		if (vq->call_ctx.ctx) {
+			if (ops->get_status(vdpa) &
+			    VIRTIO_CONFIG_S_DRIVER_OK)
+				vhost_vdpa_unsetup_vq_irq(v, idx);
+			vq->call_ctx.producer.token = NULL;
+		}
+		break;
 	}
 
 	r = vhost_vring_ioctl(&v->vdev, cmd, argp);
@@ -603,13 +609,16 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
 			cb.callback = vhost_vdpa_virtqueue_cb;
 			cb.private = vq;
 			cb.trigger = vq->call_ctx.ctx;
+			vq->call_ctx.producer.token = vq->call_ctx.ctx;
+			if (ops->get_status(vdpa) &
+			    VIRTIO_CONFIG_S_DRIVER_OK)
+				vhost_vdpa_setup_vq_irq(v, idx);
 		} else {
 			cb.callback = NULL;
 			cb.private = NULL;
 			cb.trigger = NULL;
 		}
 		ops->set_vq_cb(vdpa, idx, &cb);
-		vhost_vdpa_setup_vq_irq(v, idx);
 		break;
 
 	case VHOST_SET_VRING_NUM:
@@ -1235,6 +1244,7 @@ static int vhost_vdpa_open(struct inode *inode, struct file *filep)
 	for (i = 0; i < nvqs; i++) {
 		vqs[i] = &v->vqs[i];
 		vqs[i]->handle_kick = handle_vq_kick;
+		vqs[i]->call_ctx.ctx = NULL;
 	}
 	vhost_dev_init(dev, vqs, nvqs, 0, 0, 0, false,
 		       vhost_vdpa_process_iotlb_msg);