Re: [PATCH v2] crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

[Herbert Xu <herbert@gondor.apana.org.au>]

On Wed, May 13, 2026 at 03:47:32PM +0100, Giovanni Cabiddu wrote:
> The VF2PF interrupt handler queues PF-side response work that stores a
> raw pointer to per-VF state (struct adf_accel_vf_info). Currently,
> adf_disable_sriov() destroys per-VF mutexes and frees vf_info without
> stopping new VF2PF work or waiting for in-flight workers to complete. A
> concurrently scheduled or already queued worker can then dereference
> freed memory.
> 
> This manifests as a use-after-free when KASAN is enabled:
> 
>   BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0
>   Write of size 8 at addr 0000000000000260 by task kworker/24:2/...
>   Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]
>   Call Trace:
>     kasan_report+0x119/0x140
>     mutex_lock+0x76/0xe0
>     adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]
>     adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]
>     adf_iov_send_resp+0x8c/0xe0 [intel_qat]
>     process_one_work+0x6ac/0xfd0
>     worker_thread+0x4dd/0xd30
>     kthread+0x326/0x410
>     ret_from_fork+0x33b/0x670
> 
> Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker
> processing, and interrupt re-enabling during teardown. Set this flag
> atomically with the hardware interrupt mask inside
> adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE
> cluster MSI-X interrupt and flush the PF response workqueue before
> tearing down per-VF locks and state so all in-flight work completes
> before vf_info is destroyed.
> 
> Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and
> unmask all VF2PF interrupts under the same lock when SR-IOV is
> re-enabled. This ensures the software flag and hardware state transition
> atomically on both the enable and disable paths.
> 
> Cc: stable@vger.kernel.org
> Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV")
> Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
> ---
> Changes since v1:
> - Reworked the bail-out check in adf_enable_all_vf2pf_interrupts() to
>   compute vf_mask first and check it instead of num_vfs.
> - Removed the unreachable kfree() fallback in adf_schedule_vf2pf_handler().
>   Since pf2vf_resp is freshly allocated and initialized via INIT_WORK(),
>   queue_work() is guaranteed to return true for a work_struct that has
>   never been queued.
> - Replaced '>= 0' with '>0' after pci_irq_vector() to allow only for
>   strictly positive IRQ vectors.
> 
>  .../intel/qat/qat_common/adf_accel_devices.h  |  2 +
>  .../intel/qat/qat_common/adf_common_drv.h     |  2 +
>  drivers/crypto/intel/qat/qat_common/adf_isr.c | 39 +++++++++++++++++++
>  .../crypto/intel/qat/qat_common/adf_sriov.c   | 20 +++++++++-
>  4 files changed, 61 insertions(+), 2 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt