Re: [PATCH 1/2] vfio/cdx: Fix NULL pointer dereference in interrupt trigger path

[Prasanna Kumar T S M]

On 01-04-2026 23:52, Alex Williamson wrote:
> On Wed, 1 Apr 2026 15:11:17 +0530
> "Gupta, Nipun" <nipun.gupta@xxxxxxx> wrote:
>
> > On 20-03-2026 15:49, Prasanna Kumar T S M wrote:
> > > Add validation to ensure MSI is configured before accessing cdx_irqs
> > > array in vfio_cdx_set_msi_trigger(). Without this check, userspace
> > > can trigger a NULL pointer dereference by calling VFIO_DEVICE_SET_IRQS
> > > with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE flags before
> > > ever setting up interrupts via VFIO_IRQ_SET_DATA_EVENTFD.
> > >
> > > The vfio_cdx_msi_enable() function allocates the cdx_irqs array and
> > > sets config_msi to 1 only when called through the EVENTFD path. The
> > > trigger loop (for DATA_BOOL/DATA_NONE) assumed this had already been
> > > done, but there was no enforcement of this call ordering.
> > >
> > > This matches the protection used in the PCI VFIO driver where
> > > vfio_pci_set_msi_trigger() checks irq_is() before the trigger loop.
> > >
> > > Fixes: 848e447e000c ("vfio/cdx: add interrupt support")
> > > Cc: stable@xxxxxxxxxxxxxxx
> > > Signed-off-by: Prasanna Kumar T S M <ptsm@xxxxxxxxxxxxxxxxxxx>
> >
> > Acked-by: Nipun Gupta <nipun.gupta@xxxxxxx>
>
> It's an improvement, but I think it also highlights that interrupt
> setup for vfio-cdx devices is racy.  I think it should adopt a mutex on
> the vfio_cdx_device that is acquired with a guard in
> vfio_cdx_set_irqs_ioctl().  That would make config_msi stable for this
> test.  Thanks,
>
> Alex

This patch is fixing a specific problem. User space can make VFIO_* 
calls in a specific order to trigger NULL pointer access. This will not 
get fixed with a mutex.

Regards,
Prasanna Kumar