[PATCH v1] remoteproc: virtio: Load rvring->vq once in rproc_vq_interrupt()

[Yuho Choi <oss.patchbox@gmail.com>]

rproc_vq_interrupt() loads rvring->vq twice: once to test it for NULL and
once to pass it to vring_interrupt().  __rproc_virtio_del_vqs() clears the
same field, so the second load can return NULL after the first one has
passed the test, and vring_interrupt() dereferences its argument without
checking it.

Load the pointer once into a local variable and test that, and pair the
read with WRITE_ONCE() on the store that clears the field.

Fixes: 7a186941626d ("remoteproc: remove the single rpmsg vdev limitation")
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
Found by code review; compile-tested only.

 drivers/remoteproc/remoteproc_virtio.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/remoteproc/remoteproc_virtio.c b/drivers/remoteproc/remoteproc_virtio.c
index d5e9ff045a28a..fafd73e1368a0 100644
--- a/drivers/remoteproc/remoteproc_virtio.c
+++ b/drivers/remoteproc/remoteproc_virtio.c
@@ -89,14 +89,19 @@ static bool rproc_virtio_notify(struct virtqueue *vq)
 irqreturn_t rproc_vq_interrupt(struct rproc *rproc, int notifyid)
 {
 	struct rproc_vring *rvring;
+	struct virtqueue *vq;
 
 	dev_dbg(&rproc->dev, "vq index %d is interrupted\n", notifyid);
 
 	rvring = idr_find(&rproc->notifyids, notifyid);
-	if (!rvring || !rvring->vq)
+	if (!rvring)
+		return IRQ_NONE;
+
+	vq = READ_ONCE(rvring->vq);
+	if (!vq)
 		return IRQ_NONE;
 
-	return vring_interrupt(0, rvring->vq);
+	return vring_interrupt(0, vq);
 }
 EXPORT_SYMBOL(rproc_vq_interrupt);
 
@@ -170,7 +175,7 @@ static void __rproc_virtio_del_vqs(struct virtio_device *vdev)
 
 	list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
 		rvring = vq->priv;
-		rvring->vq = NULL;
+		WRITE_ONCE(rvring->vq, NULL);
 		vring_del_virtqueue(vq);
 	}
 }

base-commit: f0100363d8c374bd8e9ea7c9ba02744f0b802ca4
-- 
2.43.0