mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 02:17:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

vduse: hold vduse_lock across IDR lookup in open path

Browse Source 
vduse_dev_open() looks up struct vduse_dev through the IDR and then
acquires dev->lock only after vduse_lock has been dropped.

This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the
same object from the IDR and free it before the open path locks the
device, leading to a use-after-free.

Close this race by keeping vduse_lock held until dev->lock has been
acquired in the open path, matching the lock ordering already used by
the destroy path.

Fixes: c8a6153b6c ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Signed-off-by: Qihang Tang <q.h.hack.winter@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260508094659.94647-1-q.h.hack.winter@gmail.com>
This commit is contained in:
Qihang Tang
2026-05-08 17:46:59 +08:00
committed by Michael S. Tsirkin
parent bb26ed5f3a
commit e440e07774
1 changed files with 7 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/vdpa/vdpa_user/vduse_dev.c
View File

@@ -1637,26 +1637,18 @@ static int vduse_dev_release(struct inode *inode, struct file *file)
return 0;
}
static struct vduse_dev *vduse_dev_get_from_minor(int minor)
static int vduse_dev_open(struct inode *inode, struct file *file)
{
int ret = -EBUSY;
struct vduse_dev *dev;
mutex_lock(&vduse_lock);
dev = idr_find(&vduse_idr, minor);
mutex_unlock(&vduse_lock);
return dev;
}
static int vduse_dev_open(struct inode *inode, struct file *file)
{
int ret;
struct vduse_dev *dev = vduse_dev_get_from_minor(iminor(inode));
if (!dev)
dev = idr_find(&vduse_idr, iminor(inode));
if (!dev) {
mutex_unlock(&vduse_lock);
return -ENODEV;
}
ret = -EBUSY;
mutex_lock(&dev->lock);
if (dev->connected)
goto unlock;
@@ -1666,6 +1658,7 @@ static int vduse_dev_open(struct inode *inode, struct file *file)
file->private_data = dev;
unlock:
mutex_unlock(&dev->lock);
mutex_unlock(&vduse_lock);
return ret;
}