vduse: hold vduse_lock across IDR lookup in open path

vduse_dev_open() looks up struct vduse_dev through the IDR and then
acquires dev->lock only after vduse_lock has been dropped.

This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the
same object from the IDR and free it before the open path locks the
device, leading to a use-after-free.

Close this race by keeping vduse_lock held until dev->lock has been
acquired in the open path, matching the lock ordering already used by
the destroy path.

Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Signed-off-by: Qihang Tang <q.h.hack.winter@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260508094659.94647-1-q.h.hack.winter@gmail.com>

diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
index 6202f6902fcdf1ee037b33b3f07af06fc2948eba..d5c34260ed68dcecfc061445877ea800849b5d99 100644 (file)
--- a/drivers/vdpa/vdpa_user/vduse_dev.c
+++ b/drivers/vdpa/vdpa_user/vduse_dev.c
@@ -1637,26 +1637,18 @@ static int vduse_dev_release(struct inode *inode, struct file *file)
        return 0;
 }
 
-static struct vduse_dev *vduse_dev_get_from_minor(int minor)
+static int vduse_dev_open(struct inode *inode, struct file *file)
 {
+       int ret = -EBUSY;
        struct vduse_dev *dev;
 
        mutex_lock(&vduse_lock);
-       dev = idr_find(&vduse_idr, minor);
-       mutex_unlock(&vduse_lock);
-
-       return dev;
-}
-
-static int vduse_dev_open(struct inode *inode, struct file *file)
-{
-       int ret;
-       struct vduse_dev *dev = vduse_dev_get_from_minor(iminor(inode));
-
-       if (!dev)
+       dev = idr_find(&vduse_idr, iminor(inode));
+       if (!dev) {
+               mutex_unlock(&vduse_lock);
                return -ENODEV;
+       }
 
-       ret = -EBUSY;
        mutex_lock(&dev->lock);
        if (dev->connected)
                goto unlock;
@@ -1666,6 +1658,7 @@ static int vduse_dev_open(struct inode *inode, struct file *file)
        file->private_data = dev;
 unlock:
        mutex_unlock(&dev->lock);
+       mutex_unlock(&vduse_lock);
 
        return ret;
 }