commit 4fa640dc52302b5e62b01b05c755b055549633ae
author Linus Torvalds <torvalds@linux-foundation.org> Mon Jul 20 13:30:59 2020 -0700
committer Linus Torvalds <torvalds@linux-foundation.org> Mon Jul 20 13:30:59 2020 -0700
tree 4d9b62d0508d5cca0ed8d9a6ea4bfca8223627d8
parent 5714ee50bb4375bd586858ad800b1d9772847452
parent b872d0640840018669032b20b6375a478ed1f923

Merge tag 'vfio-v5.8-rc7' of git://github.com/awilliam/linux-vfio into master

Pull VFIO fix from Alex Williamson:
 "Fix race with eventfd ctx cleared outside of mutex (Zeng Tao)"

* tag 'vfio-v5.8-rc7' of git://github.com/awilliam/linux-vfio:
  vfio/pci: fix racy on error and request eventfd ctx

drivers/vfio/pci/vfio_pci.c

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index f634c81..de881a6c 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -521,14 +521,19 @@ static void vfio_pci_release(void *device_data)
 		vfio_pci_vf_token_user_add(vdev, -1);
 		vfio_spapr_pci_eeh_release(vdev->pdev);
 		vfio_pci_disable(vdev);
+		mutex_lock(&vdev->igate);
 		if (vdev->err_trigger) {
 			eventfd_ctx_put(vdev->err_trigger);
 			vdev->err_trigger = NULL;
 		}
+		mutex_unlock(&vdev->igate);
+
+		mutex_lock(&vdev->igate);
 		if (vdev->req_trigger) {
 			eventfd_ctx_put(vdev->req_trigger);
 			vdev->req_trigger = NULL;
 		}
+		mutex_unlock(&vdev->igate);
 	}
 
 	mutex_unlock(&vdev->reflck->lock);