Re: [PATCH] vfio/qat: fix f_pos race in qat_vf_resume_write()

[Alex Williamson <alex@shazbot.org>]

On Mon,  8 Jun 2026 16:12:57 +0100
Giovanni Cabiddu <giovanni.cabiddu@intel.com> wrote:

> qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but
> copies into the migration-state buffer after taking the lock and
> re-reading the shared file position.
> 
> Two concurrent writers could therefore pass the bounds check with the
> old offset, then have the second writer copy after the first advanced
> f_pos, writing past the end of the migration-state buffer.
> 
> Take migf->lock before doing the boundary checks.
> 
> Fixes: bb208810b1ab ("vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices")
> Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
> ---
>  drivers/vfio/pci/qat/main.c | 18 +++++++++++-------
>  1 file changed, 11 insertions(+), 7 deletions(-)

Applied to vfio next branch for v7.2.  Thanks,

Alex