[RESEND PATCH] vfio/virtio: Fix lock/unlock mismatch in virtiovf_read_device_context_chunk()

[RESEND PATCH] vfio/virtio: Fix lock/unlock mismatch in virtiovf_read_device_context_chunk()

[Jinhui Guo]

virtiovf_read_device_context_chunk() takes migf->list_lock with
spin_lock() but releases it with spin_unlock_irq().  This mismatch
can incorrectly enable interrupts if they were already disabled
when the lock was acquired, leading to unbalanced IRQ state.

Fix by using spin_lock_irq() to match spin_unlock_irq().

Fixes: 0bbc82e4ec79 ("vfio/virtio: Add support for the basic live migration functionality")
Cc: stable@vger.kernel.org
Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
---

Hi,

Sorry for the noise. Resent with "Cc: stable@vger.kernel.org"";
no other changes.

Best regards,
Jinhui

 drivers/vfio/pci/virtio/migrate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/pci/virtio/migrate.c b/drivers/vfio/pci/virtio/migrate.c
index 35fa2d6ed611..9fc24788fc04 100644
--- a/drivers/vfio/pci/virtio/migrate.c
+++ b/drivers/vfio/pci/virtio/migrate.c
@@ -621,7 +621,7 @@ virtiovf_read_device_context_chunk(struct virtiovf_migration_file *migf,
 
 	buf->start_pos = buf->migf->max_pos;
 	migf->max_pos += buf->length;
-	spin_lock(&migf->list_lock);
+	spin_lock_irq(&migf->list_lock);
 	list_add_tail(&buf->buf_elm, &migf->buf_list);
 	spin_unlock_irq(&migf->list_lock);
 	return 0;
-- 
2.20.1

Re: [RESEND PATCH] vfio/virtio: Fix lock/unlock mismatch in virtiovf_read_device_context_chunk()

[Alex Williamson]

On Mon, 13 Apr 2026 15:36:03 +0800
"Jinhui Guo" <guojinhui.liam@bytedance.com> wrote:

> virtiovf_read_device_context_chunk() takes migf->list_lock with
> spin_lock() but releases it with spin_unlock_irq().  This mismatch
> can incorrectly enable interrupts if they were already disabled
> when the lock was acquired, leading to unbalanced IRQ state.
> 
> Fix by using spin_lock_irq() to match spin_unlock_irq().
> 
> Fixes: 0bbc82e4ec79 ("vfio/virtio: Add support for the basic live migration functionality")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
> ---
>  drivers/vfio/pci/virtio/migrate.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/vfio/pci/virtio/migrate.c b/drivers/vfio/pci/virtio/migrate.c
> index 35fa2d6ed611..9fc24788fc04 100644
> --- a/drivers/vfio/pci/virtio/migrate.c
> +++ b/drivers/vfio/pci/virtio/migrate.c
> @@ -621,7 +621,7 @@ virtiovf_read_device_context_chunk(struct virtiovf_migration_file *migf,
>  
>  	buf->start_pos = buf->migf->max_pos;
>  	migf->max_pos += buf->length;
> -	spin_lock(&migf->list_lock);
> +	spin_lock_irq(&migf->list_lock);
>  	list_add_tail(&buf->buf_elm, &migf->buf_list);
>  	spin_unlock_irq(&migf->list_lock);
>  	return 0;

Yes, that fixes the bug, but why are we using a spinlock-irq here in
the first place?  I think this just copied the mlx5 vfio-pci variant
driver, which does make use of their list_lock under hardirq context,
but no such use case exists in this virtio driver.

A more complete fix would be to to convert list_lock to a mutex.
Thanks,

Alex