> VHOST_SET_VRING_CALL releases the previous call eventfd inside
> vhost_vring_ioctl() -- it swaps the new context into vq->call_ctx.ctx
> and then eventfd_ctx_put()s the old one, which is a synchronous
> kfree(). The parent vdpa device is only told about the change
> afterwards, when vhost_vdpa_vring_ioctl() reaches ops->set_vq_cb().
>
> Parent drivers cache the pointer handed to them in
> vdpa_callback::trigger and do not take a reference on it, so
> throughout that window the parent holds a dangling eventfd_ctx and may
> signal it. The documentation added with the field describes what
> signalling it means but says nothing about how long it stays valid.
>
> This is the same hazard that "vhost_vdpa: assign irq bypass producer
> token correctly" addressed for the irq bypass producer token, by
> moving vhost_vdpa_unsetup_vq_irq() ahead of the vhost_vring_ioctl()
> [ ... ]
> the vq's irq. VDUSE does not implement get_vq_irq, so that case stays
> covered by the teardown above.
>
> Fixes: 5e68470f4e80 ("vdpa: Add eventfd for the vdpa callback")
> Signed-off-by: Yu Zhang <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
