Re: [PATCH 1/2] vfio/cdx: Fix NULL pointer dereference in interrupt trigger path

[Alex Williamson]

On Wed, 1 Apr 2026 15:11:17 +0530
"Gupta, Nipun" <nipun.gupta@xxxxxxx> wrote:

> On 20-03-2026 15:49, Prasanna Kumar T S M wrote:
> > Add validation to ensure MSI is configured before accessing cdx_irqs
> > array in vfio_cdx_set_msi_trigger(). Without this check, userspace
> > can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS
> > with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before
> > ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD.
> > 
> > The vfio_cdx_msi_enable() function allocates the cdx_irqs array and
> > sets config_msi to 1 only when called through the EVENTFD path. The
> > trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been
> > done, but there was no enforcement of this call ordering.
> > 
> > This matches the protection used in the PCI VFIO driver where
> > vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop.
> > 
> > Fixes: 848e447e000c ("vfio/cdx: add interrupt support")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Prasanna Kumar T S M <ptsm@xxxxxxxxxxxxxxxxxxx>  
> 
> Acked-by: Nipun Gupta <nipun.gupta@xxxxxxx>

It's an improvement, but I think it also highlights that interrupt
setup for vfio-cdx devices is racy.  I think it should adopt a mutex on
the vfio_cdx_device that is acquired with a guard in
vfio_cdx_set_irqs_ioctl().  That would make config_msi stable for this
test.  Thanks,

Alex