Re: [PATCH] vhost-vdpa: initialize state before publishing cdev

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] vhost_vdpa: Use-After-Free of parent vdpa_device on probe failure
--

commit b1425fc64c0e35d298bf8e859d19dd2bf03f896d
Author: Linfeng Sun <linfeng.sun.dev@gmail.com>

vhost-vdpa: initialize state before publishing cdev

Initialize the completion and as hash buckets before cdev_device_add()
makes the device accessible.

> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index ff7d907191712..35e2f5b2293bf 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -1678,17 +1678,16 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa)
>  
>  	cdev_init(&v->cdev, &vhost_vdpa_fops);
>  	v->cdev.owner = THIS_MODULE;
> +	init_completion(&v->completion);
> +	for (i = 0; i < VHOST_VDPA_IOTLB_BUCKETS; i++)
> +		INIT_HLIST_HEAD(&v->as[i]);
>  
>  	r = cdev_device_add(&v->cdev, &v->dev);
>  	if (r)
>  		goto err;

[Severity: High]
Is there a use-after-free risk on the error path if cdev_device_add()
returns an error?

If device_add() fails within cdev_device_add(), the character device might
have already been added successfully via cdev_add(), allowing a concurrent
open() to succeed. In this scenario, vhost_vdpa_probe() jumps to err and
returns an error, causing the driver core to abandon the device bind and
free the parent vdpa_device.

However, the successfully opened file descriptor pins the vhost_vdpa object
and its file operations. When this file descriptor is later closed,
vhost_vdpa_release() is called and attempts to reset the device:

vhost_vdpa_release()
  vhost_vdpa_reset()
    _compat_vdpa_reset()
      struct vdpa_device *vdpa = v->vdpa;
      const struct vdpa_config_ops *ops = vdpa->config;

Since the parent vdpa_device has already been freed, will this dereference
result in a use-after-free?

>  
> -	init_completion(&v->completion);
>  	vdpa_set_drvdata(vdpa, v);
>  
> -	for (i = 0; i < VHOST_VDPA_IOTLB_BUCKETS; i++)
> -		INIT_HLIST_HEAD(&v->as[i]);
> -
>  	return 0;
>  
>  err:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261011-fix-null-pointer-in-vhost_vdpa_release-v1-1-43ebc225f938@gmail.com?part=1