vhost_scsi_complete_cmd_work() drops the virtqueue mutex before calling
vhost_signal(). VHOST_SET_VRING_CALL replaces call_ctx.ctx and releases the
old eventfd_ctx while holding the same mutex. vhost_signal() reads the call
context before and after vhost_notify(), so a concurrent callfd update can
make it signal a freed context or NULL.
KASAN reported the use through:
eventfd_signal_mask
vhost_signal
vhost_scsi_complete_cmd_work
The context was released through:
eventfd_ctx_put
vhost_vring_ioctl
vhost_scsi_ioctl
Keep the mutex held through vhost_signal() so completion notification and
callfd updates are serialized.
Fixes: 057cbf49a1f0 ("tcm_vhost: Initial merge for vhost level target fabric
driver")
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jia Jia <[email protected]>
---
Changes since RFC:
- Send as a non-RFC v2.
- Add Fixes and Link tags.
drivers/vhost/scsi.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 9a1253b9d8c5..7f46bc0de3c2 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -735,10 +735,9 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work
*work)
vhost_scsi_release_cmd_res(se_cmd);
}
- mutex_unlock(&svq->vq.mutex);
-
if (signal)
vhost_signal(&svq->vs->dev, &svq->vq);
+ mutex_unlock(&svq->vq.mutex);
}
static struct vhost_scsi_cmd *
--
2.34.1
