Hi, Gentle ping on this patch.
Any feedback would be appreciated. Thanks, Yuho On Tue, 22 Sept 2026 at 14:15, Yuho Choi <[email protected]> wrote: > > In cryptodev_lkcf_cleanup(), close(lkcf->eventfd) is called before > joining worker threads via qemu_thread_join(), and the eventfd read > handler registered with qemu_set_fd_handler() is never unregistered. > > If an LKCF async crypto task or a main-loop fd callback remains active > during backend cleanup: > 1. In-flight worker threads calling eventfd_write() may access a closed > or already reused file descriptor. > 2. The main-loop fd handler may fire on a reused descriptor or > reference freed LKCF backend objects, resulting in use-after-free > (UAF) or crash. > > Fix this by unregistering the eventfd handler with qemu_set_fd_handler() > prior to joining worker threads, and delaying close(lkcf->eventfd) until > all worker threads have terminated. > > Fixes: 39fff6f3e8b3 ("cryptodev: Add a lkcf-backend for cryptodev") > Signed-off-by: Yuho Choi <[email protected]> > --- > backends/cryptodev-lkcf.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/backends/cryptodev-lkcf.c b/backends/cryptodev-lkcf.c > index 3fe29d3104c..2f85c382b21 100644 > --- a/backends/cryptodev-lkcf.c > +++ b/backends/cryptodev-lkcf.c > @@ -264,10 +264,11 @@ static void cryptodev_lkcf_cleanup(CryptoDevBackend > *backend, Error **errp) > qemu_mutex_unlock(&lkcf->mutex); > qemu_cond_broadcast(&lkcf->cond); > > - close(lkcf->eventfd); > + qemu_set_fd_handler(lkcf->eventfd, NULL, NULL, NULL); > for (i = 0; i < NR_WORKER_THREAD; i++) { > qemu_thread_join(&lkcf->worker_threads[i]); > } > + close(lkcf->eventfd); > > QSIMPLEQ_FOREACH_SAFE(task, &lkcf->requests, queue, next) { > if (task->cb) { > -- > 2.43.0 >
