Re: [PATCH v2 0/2] vfio/nvgrace-gpu: Separate the fallback-mode open_device

[Alex Williamson]

On Thu, 15 Oct 2026 10:19:33 +0200
Andrea Parri <parri.andrea@xxxxxxxxx> wrote:

> In fallback mode, where the ACPI memory properties are missing or the
> C2C link is down, nvgrace-gpu opens a device through
> nvgrace_gpu_open_device() but closes it through
> vfio_pci_core_close_device().  The open registers an empty usemem range
> for poison handling that nothing unregisters, so a second open fails
> with -EBUSY, and the first open after an unbind hits a KASAN
> slab-use-after-free in register_pfn_address_space().
> 
> Patch 1 gives the fallback table its own open_device, as Alex suggested
> on v1, and is marked for stable.  Patch 2 drops a usemem length check
> in nvgrace_gpu_open_device() that only existed for fallback mode.
> 
> Tested on x86-64 under virtme-ng with KASAN, not on Grace hardware.  A
> QEMU cxl-type3 function, bound through driver_override, takes the
> fallback path and is opened through a noiommu VFIO cdev.  On v7.3-rc7
> the second open fails with -EBUSY and the open after unbind and rebind
> reports the use-after-free.  With patch 1, and with the whole series,
> neither happens.  Patch 2 only affects full mode, which this setup
> cannot reach.
> 
> Changes in v2:
> - Replace the usemem.memlength guards with a core-only open_device for
>   the fallback table (Alex)
> - Add patch 2
> - Fallback open no longer fails when BAR0 cannot be mapped; Ankit
>   confirmed fallback mode does not need that check
> - Rebase on v7.3-rc7
> 
> v1: https://lore.kernel.org/r/20260925161024.189771-1-parri.andrea@xxxxxxxxx/
> 
> Andrea Parri (2):
>   vfio/nvgrace-gpu: Use a core-only open_device in fallback mode
>   vfio/nvgrace-gpu: Drop the usemem length check in open_device
> 
>  drivers/vfio/pci/nvgrace-gpu/main.c | 23 ++++++++++++++++++-----
>  1 file changed, 18 insertions(+), 5 deletions(-)
> 
> 
> base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907

Applied to vfio next branch for v7.4.  Thanks,

Alex