Mike Christie a284f09eff vhost: Fix crash during early vhost_transport_send_pkt calls ... If userspace does VHOST_VSOCK_SET_GUEST_CID before VHOST_SET_OWNER we can race where: 1. thread0 calls vhost_transport_send_pkt -> vhost_work_queue 2. thread1 does VHOST_SET_OWNER which calls vhost_worker_create. 3. vhost_worker_create will set the dev->worker pointer before setting the worker->vtsk pointer. 4. thread0's vhost_work_queue will see the dev->worker pointer is set and try to call vhost_task_wake using not yet set worker->vtsk pointer. 5. We then crash since vtsk is NULL. Before commit 6e890c5d50 ("vhost: use vhost_tasks for worker threads"), we only had the worker pointer so we could just check it to see if VHOST_SET_OWNER has been done. After that commit we have the vhost_worker and vhost_task pointer, so we can now hit the bug above. This patch embeds the vhost_worker in the vhost_dev and moves the work list initialization back to vhost_dev_init, so we can just check the worker.vtsk pointer to check if VHOST_SET_OWNER has been done like before. Fixes: 6e890c5d50 ("vhost: use vhost_tasks for worker threads") Signed-off-by: Mike Christie <michael.christie@oracle.com> Message-Id: <20230607192338.6041-2-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reported-by: syzbot+d0d442c22fa8db45ff0e@syzkaller.appspotmail.com Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>		2023-06-08 15:43:09 -04:00
..
iotlb.c	vhost_iotlb: split out IOTLB initialization	2022-05-31 12:44:28 -04:00
Kconfig	vhost_task: Allow vhost layer to use copy_process	2023-03-23 12:45:36 +01:00
Makefile	vhost: introduce vDPA-based backend	2020-04-02 10:41:40 -04:00
net.c	vhost_net: revert upend_idx only on retriable error	2023-06-08 15:43:08 -04:00
scsi.c	virtio,vhost,vdpa: features, fixes, cleanups	2023-04-27 17:05:34 -07:00
test.c	vhost-test: remove meaningless debug info	2023-02-20 19:26:58 -05:00
test.h	tools/virtio: Add --reset	2020-06-22 12:34:21 -04:00
vdpa.c	vhost_vdpa: tell vqs about the negotiated	2023-06-08 15:43:08 -04:00
vhost.c	vhost: Fix crash during early vhost_transport_send_pkt calls	2023-06-08 15:43:09 -04:00
vhost.h	vhost: Fix crash during early vhost_transport_send_pkt calls	2023-06-08 15:43:09 -04:00
vringh.c	vringh: support VA with iotlb	2023-04-21 03:02:33 -04:00
vsock.c	vsock: support sockmap	2023-03-29 08:19:38 +01:00