Re: [syzbot] [kvm?] [net?] [virt?] general protection fault in vhost_work_queue

From: Stefano Garzarella
Date: Tue May 30 2023 - 12:14:29 EST

On Tue, May 30, 2023 at 11:01:11AM -0500, Mike Christie wrote:
On 5/30/23 10:58 AM, Mike Christie wrote:
On 5/30/23 8:44 AM, Stefano Garzarella wrote:

From a first glance, it looks like an issue when we call vhost_work_queue().
@Mike, does that ring any bells since you recently looked at that code?

I see the bug. needed to have set the dev->worker after setting worker->vtsk

Yes, I came to the same conclusion (see my email sent at the same time

like below:

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index a92af08e7864..7bd95984a501 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -564,7 +564,6 @@ static int vhost_worker_create(struct vhost_dev *dev)
if (!worker)
return -ENOMEM;

- dev->worker = worker;
worker->kcov_handle = kcov_common_handle();
snprintf(name, sizeof(name), "vhost-%d", current->pid);
@@ -576,6 +575,7 @@ static int vhost_worker_create(struct vhost_dev *dev)

worker->vtsk = vtsk;

Shoot, oh wait, I think I needed a smp_wmb to always make sure worker->vtask
is set before dev->worker or vhost_work_queue could still end up seeing
dev->worker set before worker->vtsk right?

But should we pair smp_wmb() with an smp_rmb() wherever we check dev->worker?