Re: [PATCH] vfio/pci: fix dma-buf kref underflow after revoke

[Alex Williamson <alex@shazbot.org>]

On Thu,  7 May 2026 08:35:46 -0600
Alex Williamson <alex.williamson@nvidia.com> wrote:

> vfio_pci_dma_buf_move(revoked=true) and vfio_pci_dma_buf_cleanup()
> ran the same drain sequence: set priv->revoked, invalidate mappings,
> wait for fences, drop the registered kref, wait for completion.
> When the VFIO device fd was closed after PCI_COMMAND_MEMORY had been
> cleared, both ran in turn -- the second kref_put underflowed and the
> subsequent wait_for_completion() blocked on a completion that the
> first run had already consumed:
> 
>   refcount_t: underflow; use-after-free.
>   WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x59/0x90
>   Call Trace:
>    vfio_pci_dma_buf_cleanup+0x163/0x168 [vfio_pci_core]
>    vfio_pci_core_close_device+0x67/0xe0 [vfio_pci_core]
>    vfio_df_close+0x4c/0x80 [vfio]
>    vfio_df_group_close+0x36/0x80 [vfio]
>    vfio_device_fops_release+0x21/0x40 [vfio]
>    __fput+0xe6/0x2b0
>    __x64_sys_close+0x3d/0x80
> 
> Collapse the duplication: vfio_pci_dma_buf_cleanup() now delegates
> the drain to vfio_pci_dma_buf_move(true), which is idempotent for
> already-revoked dma-bufs.  cleanup retains only list removal and
> the device registration drop; the dma_resv_lock that bracketed
> those is dropped along with the in-line drain that required it,
> memory_lock continues to protect them.
> 
> Re-arm the kref and the completion at the end of move()'s revoke
> branch so post-revoke state matches post-creation (kref == 1,
> completion ready).  This keeps cleanup's call into move() a no-op
> when revoke already ran, and replaces the explicit kref_init() that
> the un-revoke branch used to perform for the un-revoke -> remap
> path.
> 
> Fixes: 1a8a5227f229 ("vfio: Wait for dma-buf invalidation to complete")
> Reported-by: Joonas Kylmälä <joonas.kylmala@netum.fi>
> Closes: https://lore.kernel.org/all/GVXPR02MB12019AA6014F27EF5D773E89BFB372@GVXPR02MB12019.eurprd02.prod.outlook.com/
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-7
> Reviewed-by: Leon Romanovsky <leon@kernel.org>
> Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
> ---
> 
> Multiple fixes were proposed[1][2][3] to resolve this issue, thank you
> all!  This is the solution the Leon supported, therefore I'm posting it
> on its own for a clean reference and visibility.  I'll intend to push
> this for v7.1-rc.
> 
> [1]https://lore.kernel.org/all/20260416131815.2729131-2-mattev@meta.com
> [2]https://lore.kernel.org/all/20260429182736.409323-2-clopez@suse.de/
> [3]https://lore.kernel.org/all/20260429142242.70f746b4@nvidia.com/
> 
>  drivers/vfio/pci/vfio_pci_dmabuf.c | 36 +++++++++++++++---------------
>  1 file changed, 18 insertions(+), 18 deletions(-)

Applied to vfio for-linus branch for v7.1-rc.  Thanks,

Alex