Skip to content

Commit 6b4abb5

Browse files
Nikolay Kuratovgregkh
authored andcommitted
vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
commit dd54bcf upstream. When operating on struct vhost_net_ubuf_ref, the following execution sequence is theoretically possible: CPU0 is finalizing DMA operation CPU1 is doing VHOST_NET_SET_BACKEND // ubufs->refcount == 2 vhost_net_ubuf_put() vhost_net_ubuf_put_wait_and_free(oldubufs) vhost_net_ubuf_put_and_wait() vhost_net_ubuf_put() int r = atomic_sub_return(1, &ubufs->refcount); // r = 1 int r = atomic_sub_return(1, &ubufs->refcount); // r = 0 wait_event(ubufs->wait, !atomic_read(&ubufs->refcount)); // no wait occurs here because condition is already true kfree(ubufs); if (unlikely(!r)) wake_up(&ubufs->wait); // use-after-free This leads to use-after-free on ubufs access. This happens because CPU1 skips waiting for wake_up() when refcount is already zero. To prevent that use a read-side RCU critical section in vhost_net_ubuf_put(), as suggested by Hillf Danton. For this lock to take effect, free ubufs with kfree_rcu(). Cc: stable@vger.kernel.org Fixes: 0ad8b48 ("vhost: fix ref cnt checking deadlock") Reported-by: Andrey Ryabinin <arbn@yandex-team.com> Suggested-by: Hillf Danton <hdanton@sina.com> Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru> Message-Id: <20250805130917.727332-1-kniv@yandex-team.ru> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent d9eb5a9 commit 6b4abb5

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

drivers/vhost/net.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ struct vhost_net_ubuf_ref {
9696
atomic_t refcount;
9797
wait_queue_head_t wait;
9898
struct vhost_virtqueue *vq;
99+
struct rcu_head rcu;
99100
};
100101

101102
#define VHOST_NET_BATCH 64
@@ -247,9 +248,13 @@ vhost_net_ubuf_alloc(struct vhost_virtqueue *vq, bool zcopy)
247248

248249
static int vhost_net_ubuf_put(struct vhost_net_ubuf_ref *ubufs)
249250
{
250-
int r = atomic_sub_return(1, &ubufs->refcount);
251+
int r;
252+
253+
rcu_read_lock();
254+
r = atomic_sub_return(1, &ubufs->refcount);
251255
if (unlikely(!r))
252256
wake_up(&ubufs->wait);
257+
rcu_read_unlock();
253258
return r;
254259
}
255260

@@ -262,7 +267,7 @@ static void vhost_net_ubuf_put_and_wait(struct vhost_net_ubuf_ref *ubufs)
262267
static void vhost_net_ubuf_put_wait_and_free(struct vhost_net_ubuf_ref *ubufs)
263268
{
264269
vhost_net_ubuf_put_and_wait(ubufs);
265-
kfree(ubufs);
270+
kfree_rcu(ubufs, rcu);
266271
}
267272

268273
static void vhost_net_clear_ubuf_info(struct vhost_net *n)

0 commit comments

Comments
 (0)