[Devel] [PATCH VZ9] drivers/vhost: fix missing rcu_read_lock in vhost_work_queue

[Konstantin Khorenko]

Andrey, please review the patch.

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 22.01.2024 07:54, Pavel Tikhomirov wrote:
> In this stack:
> 
>    +-> vhost_vsock_dev_ioctl
>      +-> vhost_vsock_start
>        +-> vhost_work_queue
>          +-> xas_find
>            +-> xas_load
>              +-> xas_start
>                +-> xa_head
>                  +-> rcu_dereference_check
> 
> We require either rcu_read_lock or xa_lock but have none. Let's fix it
> by calling a xa_find, which is a wraper for xas_find having proper rcu
> and also xas_retry logic.
> 
> https://virtuozzo.atlassian.net/browse/PSBM-153264
> Fixes: 5271bf51f1b83 ("ms/vhost: replace single worker pointer with xarray")
> Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
> 
> Feature: vhost-blk: in-kernel accelerator for virtio-blk guests
> ---
>   drivers/vhost/vhost.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> index c32557e279dfb..2f45c8d2b6fd6 100644
> --- a/drivers/vhost/vhost.c
> +++ b/drivers/vhost/vhost.c
> @@ -257,10 +257,10 @@ static bool vhost_worker_queue(struct vhost_worker *worker,
>   
>   bool vhost_work_queue(struct vhost_dev *dev, struct vhost_work *work)
>   {
> -	XA_STATE(xas, &dev->worker_xa, 0);
>   	struct vhost_worker *worker;
> +	unsigned long i;
>   
> -	worker = xas_find(&xas, UINT_MAX);
> +	worker = xa_find(&dev->worker_xa, &i, ULONG_MAX, XA_PRESENT);
>   	if (!worker)
>   		return false;
>