From nobody Sat Sep 26 19:59:29 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1790101010; cv=none; d=zohomail.com; s=zohoarc; b=Hr58qEaf4Ri0NVM88+DHLRuqp2hiHWYeXO2cimeoKNA3AllStSNYuQi/AcFa+s2LZCkLjBi0gPR+fDFgtSFsvm/dJrTc8SUK8VgAj2j9kHT4J6Ar0aqxtAO0jIvmOst+NoQbRjToa2WThR7nGBzBaqr99Ll3gGN70j0FxG5KzRI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1790101010; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bdchGATpBJ/Ac4UQhNiWhj9IkXn8QY/w59BNmjbPJyA=; b=Md5BqjL3tDW0FIf5JvuMHTiQKGAmcTwbDVRq64iJVQE3TcyxNGq93LNNL457ocEky+WnMy5b7OJCqyNCihwNytvWD0yn10IPmruuat5TejPoR/30awnBUjYM2jioIvyhwqqPH5bdBckj8Rn2+swohWkbBH2X7D24aNQhzi4J+CA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1790101010294246.1432879652575; Tue, 22 Sep 2026 11:16:50 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x952D-00026i-Id; Tue, 22 Sep 2026 14:16:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x952A-00026V-JK for qemu-devel@nongnu.org; Tue, 22 Sep 2026 14:16:03 -0400 Received: from mail-vs2-x0f.google.com ([2a00:1450:4864:3a::f]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1x9529-0003ZB-3j for qemu-devel@nongnu.org; Tue, 22 Sep 2026 14:16:02 -0400 Received: by mail-vs2-x0f.google.com with SMTP id ada2fe7eead31-785686d2112so43329137.3 for ; Tue, 22 Sep 2026 11:15:59 -0700 (PDT) Received: from i4-gl-tmk5904.ad.psu.edu ([130.203.156.186]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-9140c432220sm3174786d6.28.2026.09.22.11.15.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 22 Sep 2026 11:15:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790100958; x=1790705758; darn=nongnu.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=bdchGATpBJ/Ac4UQhNiWhj9IkXn8QY/w59BNmjbPJyA=; b=DBTvDDx3W5J5qi2GcsgKnbbSWwBK1bF6AQ44L+2s2Oa2G+Xh01GGKhw7gdRRlJ53sw h1I1oDZ3axw7rULH5rRWrm1RmhEJm4cyZAKe4fIJ2q9cDBbZItlpAlPBLf3osvDQUHEq 8RMHEaQW44UOyNiSudJmUEc8FChU85POSS9VWHg3m2tLVrlAmScsmp25kt4T40tD0Pn5 H8xOmnALuWDXaItWxuyHBWjTDltVdWMxUG9jEqM6hrG23Sws4G3mYVQ1XezoFzeDs8CW NrRSA5FNUQEcbVcrSGDqMJfH3zJ0Nf/uP0ChyFElWaFTbBtzE4b++GbMxGR2ne5MSOLc vueQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790100958; x=1790705758; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bdchGATpBJ/Ac4UQhNiWhj9IkXn8QY/w59BNmjbPJyA=; b=I2wjPeA2XdM7f5eGyjKRM7Rz5Gx4P+UoTeeIMhzl5LAU9OSZjd7zfCV9yD86acWnL+ zo5+oZw2mYoT9IK9z3q9FYXaR/jepVanY5zD3ygvmzH/ikto29nPNHVsDmLs+kj+d8DT vrJqRfeAXDrQysEeQA9Zs0aUhzLJChZLfGKaCkYm85gwaxLQ2QVA+HBk6EG+dUm8r5Ro kURl/VJCVQ1n4JB3rFX/w1FQGBvDP/ViNrIPl8h1rfQ5dEbIFjPs1pd/EvSM/ol2Jna6 72b49bnOxMbEs49kZ2TZKF4WN8Q7odb/JgONbyHdkeGcvSagsQ7g5sXUp3UwNN+URQ2t H6TQ== X-Gm-Message-State: AFuF++m2rNWNyw1Rhp6tysiEOEJ9SNybo3Hn9V5YgPmtRDaPHi127DA7 Gt6PEXhrXQD7bDnVuKnGoj0e/R0B6uGg7fTokKe3qZLOYUz29CHYKU4/jTbgFLOY X-Gm-Gg: AYBFou00vWYJXKxJeLMsJOrD9+cZmm4J6uH10HzSWSilkzX4hJ7pOBlaWYjBFymLmFl XKP4GLZRd/f7IfyvEACGpL/unyl0lUEMRToy778LpB8P9NBNNLETQr9XG54khw4AnaJzWDLvYv3 FDKs26gyHhVXarHTVFx+eD6T/QumwOe45TqDA+kIgq+FUurKHUf0aO2BO+AgR16ZBFiLBjefLk6 CjY9aLyZ5rc0GmWhew8qUJ9pU7yE0Nsu+UkA6ACaC8X/DTOWLYANSMN/no37snbtqAvWFnkNd19 it5MbYEcpmCroksJ4gTjJkyhiMqUO/7CadMEHOpV2SVSLmR3g6+OVAx1Z+MwDRmMkJkjxo2E6mW 4siZyxJdVKrZHwWJ/ega5ia09cHffsgLgvr/sp6OyO3jPY3zMkXKTuzslIioRW2+Bqt9qgxCWnM bysTeCqE4vKucVe8vioLEv5gU6lf/wGBYHJWOhbe2Lxw0cuIY6QLvUia6ajcA7grA8QlT/fblWM flatjBoNXHZP51+m6mdag== X-Received: by 2002:a05:6102:4b0a:b0:7a5:e455:1823 with SMTP id ada2fe7eead31-7ac1d4f39fdmr202071137.27.1790100958394; Tue, 22 Sep 2026 11:15:58 -0700 (PDT) From: Yuho Choi To: qemu-devel@nongnu.org Cc: Gonglei , zhenwei pi , Yuho Choi Subject: [PATCH v1] backends/cryptodev-lkcf: fix teardown order of eventfd and workers Date: Tue, 22 Sep 2026 14:15:26 -0400 Message-ID: <20260922181548.499505-1-oss.patchbox@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2a00:1450:4864:3a::f; envelope-from=oss.patchbox@gmail.com; helo=mail-vs2-x0f.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1790101012191158500 Content-Type: text/plain; charset="utf-8" In cryptodev_lkcf_cleanup(), close(lkcf->eventfd) is called before joining worker threads via qemu_thread_join(), and the eventfd read handler registered with qemu_set_fd_handler() is never unregistered. If an LKCF async crypto task or a main-loop fd callback remains active during backend cleanup: 1. In-flight worker threads calling eventfd_write() may access a closed or already reused file descriptor. 2. The main-loop fd handler may fire on a reused descriptor or reference freed LKCF backend objects, resulting in use-after-free (UAF) or crash. Fix this by unregistering the eventfd handler with qemu_set_fd_handler() prior to joining worker threads, and delaying close(lkcf->eventfd) until all worker threads have terminated. Fixes: 39fff6f3e8b3 ("cryptodev: Add a lkcf-backend for cryptodev") Signed-off-by: Yuho Choi --- backends/cryptodev-lkcf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backends/cryptodev-lkcf.c b/backends/cryptodev-lkcf.c index 3fe29d3104c..2f85c382b21 100644 --- a/backends/cryptodev-lkcf.c +++ b/backends/cryptodev-lkcf.c @@ -264,10 +264,11 @@ static void cryptodev_lkcf_cleanup(CryptoDevBackend *= backend, Error **errp) qemu_mutex_unlock(&lkcf->mutex); qemu_cond_broadcast(&lkcf->cond); =20 - close(lkcf->eventfd); + qemu_set_fd_handler(lkcf->eventfd, NULL, NULL, NULL); for (i =3D 0; i < NR_WORKER_THREAD; i++) { qemu_thread_join(&lkcf->worker_threads[i]); } + close(lkcf->eventfd); =20 QSIMPLEQ_FOREACH_SAFE(task, &lkcf->requests, queue, next) { if (task->cb) { --=20 2.43.0