vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex

vfio_cdx_set_msi_trigger() reads vdev->config_msi and operates on the
vdev->cdx_irqs array based on its value, but provides no serialization
against concurrent VFIO_DEVICE_SET_IRQS ioctls.  Two callers can race
such that one observes config_msi as set while another clears it and
frees cdx_irqs via vfio_cdx_msi_disable(), resulting in a use-after-free
of the cdx_irqs array.

Add a cdx_irqs_lock mutex to struct vfio_cdx_device and acquire it in
vfio_cdx_set_msi_trigger(), which is the single chokepoint through
which all updates to config_msi, cdx_irqs, and msi_count flow, covering
both the ioctl path and the close-device cleanup path.  This keeps the
test of config_msi atomic with the subsequent enable, disable, or
trigger operations.

Drop the pre-call !cdx_irqs test from vfio_cdx_irqs_cleanup() as part
of this change: the optimization it provided is redundant with the
!config_msi early-return inside vfio_cdx_msi_disable(), and leaving the
test in place would be an unsynchronized read of state the new lock is
meant to protect.

Fixes: 848e447e000c ("vfio/cdx: add interrupt support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Acked-by: Nikhil Agarwal <nikhil.agarwal@amd.com>
Link: https://lore.kernel.org/r/20260417202800.88287-3-alex.williamson@nvidia.com
Signed-off-by: Alex Williamson <alex@shazbot.org>

diff --git a/drivers/vfio/cdx/intr.c b/drivers/vfio/cdx/intr.c
index c0eed065e8ef71dbddaa374f883f0114deb16936..6dfe0ced3bdd8a1dc45956d12fb908ba7cc9ac03 100644 (file)
--- a/drivers/vfio/cdx/intr.c
+++ b/drivers/vfio/cdx/intr.c
@@ -152,6 +152,8 @@ static int vfio_cdx_set_msi_trigger(struct vfio_cdx_device *vdev,
        if (start + count > cdx_dev->num_msi)
                return -EINVAL;
 
+       guard(mutex)(&vdev->cdx_irqs_lock);
+
        if (!count && (flags & VFIO_IRQ_SET_DATA_NONE)) {
                vfio_cdx_msi_disable(vdev);
                return 0;
@@ -210,12 +212,5 @@ int vfio_cdx_set_irqs_ioctl(struct vfio_cdx_device *vdev,
 /* Free All IRQs for the given device */
 void vfio_cdx_irqs_cleanup(struct vfio_cdx_device *vdev)
 {
-       /*
-        * Device does not support any interrupt or the interrupts
-        * were not configured
-        */
-       if (!vdev->cdx_irqs)
-               return;
-
        vfio_cdx_set_msi_trigger(vdev, 0, 0, 0, VFIO_IRQ_SET_DATA_NONE, NULL);
 }

diff --git a/drivers/vfio/cdx/main.c b/drivers/vfio/cdx/main.c
index 8ab97405b2bddafb0dc314064f9de9f0fcceaf3e..b31ed4be7bdc19b1bc55c007b2ff19e2329adb27 100644 (file)
--- a/drivers/vfio/cdx/main.c
+++ b/drivers/vfio/cdx/main.c
@@ -8,6 +8,23 @@
 
 #include "private.h"
 
+static int vfio_cdx_init_dev(struct vfio_device *core_vdev)
+{
+       struct vfio_cdx_device *vdev =
+               container_of(core_vdev, struct vfio_cdx_device, vdev);
+
+       mutex_init(&vdev->cdx_irqs_lock);
+       return 0;
+}
+
+static void vfio_cdx_release_dev(struct vfio_device *core_vdev)
+{
+       struct vfio_cdx_device *vdev =
+               container_of(core_vdev, struct vfio_cdx_device, vdev);
+
+       mutex_destroy(&vdev->cdx_irqs_lock);
+}
+
 static int vfio_cdx_open_device(struct vfio_device *core_vdev)
 {
        struct vfio_cdx_device *vdev =
@@ -273,6 +290,8 @@ static int vfio_cdx_mmap(struct vfio_device *core_vdev,
 
 static const struct vfio_device_ops vfio_cdx_ops = {
        .name           = "vfio-cdx",
+       .init           = vfio_cdx_init_dev,
+       .release        = vfio_cdx_release_dev,
        .open_device    = vfio_cdx_open_device,
        .close_device   = vfio_cdx_close_device,
        .ioctl          = vfio_cdx_ioctl,

diff --git a/drivers/vfio/cdx/private.h b/drivers/vfio/cdx/private.h
index 172e48caa3a06274f0122d486ec757139772c048..94374b5fc9899cc39f2ad806ddb2b8028d0e7a07 100644 (file)
--- a/drivers/vfio/cdx/private.h
+++ b/drivers/vfio/cdx/private.h
@@ -6,6 +6,8 @@
 #ifndef VFIO_CDX_PRIVATE_H
 #define VFIO_CDX_PRIVATE_H
 
+#include <linux/mutex.h>
+
 #define VFIO_CDX_OFFSET_SHIFT    40
 
 static inline u64 vfio_cdx_index_to_offset(u32 index)
@@ -31,6 +33,7 @@ struct vfio_cdx_region {
 struct vfio_cdx_device {
        struct vfio_device      vdev;
        struct vfio_cdx_region  *regions;
+       struct mutex            cdx_irqs_lock;
        struct vfio_cdx_irq     *cdx_irqs;
        u32                     flags;
 #define BME_SUPPORT BIT(0)