Re: [PATCH v5 06/20] vfio/pci: Preserve vfio-pci device files across Live Update

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Lockless checks of `vfio_pci_dev_is_frozen()` in IOCTL and read/write handlers allow userspace to bypass the freeze state, breaking kexec handoff guarantees.
- [Medium] `vdev->liveupdate_frozen` is never cleared and `unfreeze` is unimplemented, permanently bricking the VFIO device if a kexec aborts.
--

--- Patch [6]: [PATCH v5 06/20] vfio/pci: Preserve vfio-pci device files across Live Update ---
commit 03e42ce3ade0f06aa286a1a8cacc4d3f5d2537c0
Author: Vipin Sharma <vipinsh@google.com>
vfio/pci: Preserve vfio-pci device files across Live Update

This commit implements the Live Update file handler callbacks to preserve a
vfio-pci device across a Live Update. It serializes device state into
vfio_pci_core_device_ser and resets the device during the freeze phase.

> diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
> index f31e59e5badb4..c312b0eaf7d00 100644
> --- a/drivers/vfio/pci/vfio_pci_core.c
> +++ b/drivers/vfio/pci/vfio_pci_core.c
[ ... ]
> @@ -1513,6 +1516,9 @@ long vfio_pci_core_ioctl(struct vfio_device *core_vdev, unsigned int cmd,
>  		container_of(core_vdev, struct vfio_pci_core_device, vdev);
>  	void __user *uarg = (void __user *)arg;
>  
> +	if (vfio_pci_dev_is_frozen(vdev))
> +		return -EIO;
> +

[Severity: High]
Can a userspace thread race with the freeze operation here?

If a thread locklessly evaluates vfio_pci_dev_is_frozen() as false and then
blocks waiting for vdev->igate or vdev->memory_lock, couldn't
vfio_pci_liveupdate_freeze() concurrently acquire those locks, freeze the
device, set liveupdate_frozen to true, and release the locks?

The ioctl thread would then wake up, acquire the lock, and modify the frozen
device's state.

> diff --git a/drivers/vfio/pci/vfio_pci_liveupdate.c b/drivers/vfio/pci/vfio_pci_liveupdate.c
> index 803528c9f1b27..e6eb7f6b53d7f 100644
> --- a/drivers/vfio/pci/vfio_pci_liveupdate.c
> +++ b/drivers/vfio/pci/vfio_pci_liveupdate.c
[ ... ]
> @@ -6,28 +6,221 @@
> +static int vfio_pci_liveupdate_freeze(struct liveupdate_file_op_args *args)
> +{
[ ... ]
> +	/*
> +	 * Userspace cannot use the FD correctly now irrespective of liveupdate
> +	 * freeze failing or succeeding. They will have to reinitialize the VFIO
> +	 * device to continue using it as reset might have loaded default PCI
> +	 * state. Disable ioctl, read, write and mmap access to the device.
> +	 */
> +	smp_store_release(&vdev->liveupdate_frozen, true);
> +	return 0;
> +}

[Severity: Medium]
Does this permanently brick the VFIO device if a kexec aborts?

The liveupdate_frozen flag is set to true here, but it looks like there is
no corresponding clear on device close/open or kexec abort.

Because the unfreeze operation callback in vfio_pci_liveupdate_file_ops is
unimplemented, the flag would remain set. Userspace attempting to recover
by closing and reopening the FD would continue to receive -EIO until the
driver is unbound.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714151505.3466855-1-vipinsh@google.com?part=6