Re: [PATCH v2] vhost-vdpa: drop the parent's vq callback before the call fd is released

[sashiko-bot@kernel.org]

> VHOST_SET_VRING_CALL releases the previous call eventfd inside
> vhost_vring_ioctl() -- it swaps the new context into vq->call_ctx.ctx
> and then eventfd_ctx_put()s the old one, which is a synchronous
> kfree(). The parent vdpa device is only told about the change
> afterwards, when vhost_vdpa_vring_ioctl() reaches ops->set_vq_cb().
> 
> Parent drivers cache the pointer handed to them in
> vdpa_callback::trigger and do not take a reference on it, so
> throughout that window the parent holds a dangling eventfd_ctx and may
> signal it. The documentation added with the field describes what
> signalling it means but says nothing about how long it stays valid.
> 
> This is the same hazard that "vhost_vdpa: assign irq bypass producer
> token correctly" addressed for the irq bypass producer token, by
> moving vhost_vdpa_unsetup_vq_irq() ahead of the vhost_vring_ioctl()
> [ ... ]
> the vq's irq. VDUSE does not implement get_vq_irq, so that case stays
> covered by the teardown above.
> 
> Fixes: 5e68470f4e80 ("vdpa: Add eventfd for the vdpa callback")
> Signed-off-by: Yu Zhang <yuz08559@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918040436.47982-1-yuz08559@gmail.com?part=1