[PATCH v1] remoteproc: virtio: Load rvring->vq once in rproc_vq_interrupt()

[Yuho Choi]

rproc_vq_interrupt() loads rvring->vq twice: once to test it for NULL and
once to pass it to vring_interrupt().  __rproc_virtio_del_vqs() clears the
same field, so the second load can return NULL after the first one has
passed the test, and vring_interrupt() dereferences its argument without
checking it.

Load the pointer once into a local variable and test that, and pair the
read with WRITE_ONCE() on the store that clears the field.

Fixes: 7a186941626d ("remoteproc: remove the single rpmsg vdev limitation")
Signed-off-by: Yuho Choi <oss.patch...@gmail.com>
---
Found by code review; compile-tested only.

 drivers/remoteproc/remoteproc_virtio.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/remoteproc/remoteproc_virtio.c 
b/drivers/remoteproc/remoteproc_virtio.c
index d5e9ff045a28a..fafd73e1368a0 100644
--- a/drivers/remoteproc/remoteproc_virtio.c
+++ b/drivers/remoteproc/remoteproc_virtio.c
@@ -89,14 +89,19 @@ static bool rproc_virtio_notify(struct virtqueue *vq)
 irqreturn_t rproc_vq_interrupt(struct rproc *rproc, int notifyid)
 {
        struct rproc_vring *rvring;
+       struct virtqueue *vq;
 
        dev_dbg(&rproc->dev, "vq index %d is interrupted\n", notifyid);
 
        rvring = idr_find(&rproc->notifyids, notifyid);
-       if (!rvring || !rvring->vq)
+       if (!rvring)
+               return IRQ_NONE;
+
+       vq = READ_ONCE(rvring->vq);
+       if (!vq)
                return IRQ_NONE;
 
-       return vring_interrupt(0, rvring->vq);
+       return vring_interrupt(0, vq);
 }
 EXPORT_SYMBOL(rproc_vq_interrupt);
 
@@ -170,7 +175,7 @@ static void __rproc_virtio_del_vqs(struct virtio_device 
*vdev)
 
        list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
                rvring = vq->priv;
-               rvring->vq = NULL;
+               WRITE_ONCE(rvring->vq, NULL);
                vring_del_virtqueue(vq);
        }
 }

base-commit: f0100363d8c374bd8e9ea7c9ba02744f0b802ca4
-- 
2.43.0