torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()

Browse Source 
When operating on struct vhost_net_ubuf_ref, the following execution
sequence is theoretically possible:
CPU0 is finalizing DMA operation                   CPU1 is doing VHOST_NET_SET_BACKEND
                             // ubufs->refcount == 2
vhost_net_ubuf_put()                               vhost_net_ubuf_put_wait_and_free(oldubufs)
                                                     vhost_net_ubuf_put_and_wait()
                                                       vhost_net_ubuf_put()
                                                         int r = atomic_sub_return(1, &ubufs->refcount);
                                                         // r = 1
int r = atomic_sub_return(1, &ubufs->refcount);
// r = 0
                                                      wait_event(ubufs->wait, !atomic_read(&ubufs->refcount));
                                                      // no wait occurs here because condition is already true
                                                    kfree(ubufs);
if (unlikely(!r))
  wake_up(&ubufs->wait);  // use-after-free

This leads to use-after-free on ubufs access. This happens because CPU1
skips waiting for wake_up() when refcount is already zero.

To prevent that use a read-side RCU critical section in vhost_net_ubuf_put(),
as suggested by Hillf Danton. For this lock to take effect, free ubufs with
kfree_rcu().

Cc: stable@vger.kernel.org
Fixes: 0ad8b480d6 ("vhost: fix ref cnt checking deadlock")
Reported-by: Andrey Ryabinin <arbn@yandex-team.com>
Suggested-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
Message-Id: <20250805130917.727332-1-kniv@yandex-team.ru>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Nikolay Kuratov 2025-08-05 16:09:17 +03:00 committed by Michael S. Tsirkin
parent a39d13e291
commit dd54bcf86c
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/vhost/net.c
View File

@ -99,6 +99,7 @@ struct vhost_net_ubuf_ref {
atomic_t refcount; atomic_t refcount;
wait_queue_head_t wait; wait_queue_head_t wait;
struct vhost_virtqueue *vq; struct vhost_virtqueue *vq;
struct rcu_head rcu;
}; };
#define VHOST_NET_BATCH 64 #define VHOST_NET_BATCH 64
@ -250,9 +251,13 @@ vhost_net_ubuf_alloc(struct vhost_virtqueue *vq, bool zcopy)
static int vhost_net_ubuf_put(struct vhost_net_ubuf_ref *ubufs) static int vhost_net_ubuf_put(struct vhost_net_ubuf_ref *ubufs)
{ {
int r = atomic_sub_return(1, &ubufs->refcount); int r;
rcu_read_lock();
r = atomic_sub_return(1, &ubufs->refcount);
if (unlikely(!r)) if (unlikely(!r))
wake_up(&ubufs->wait); wake_up(&ubufs->wait);
rcu_read_unlock();
return r; return r;
} }
@ -265,7 +270,7 @@ static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs)
static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs) static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs)
{ {
vhost_net_ubuf_put_and_wait(ubufs); vhost_net_ubuf_put_and_wait(ubufs);
kfree(ubufs); kfree_rcu(ubufs, rcu);
} }
static void vhost_net_clear_ubuf_info(struct vhost_net *n) static void vhost_net_clear_ubuf_info(struct vhost_net *n)