Skip to contentSkip to conversation

vfio/pci: Clean up DMABUFs before disabling function

PATCH In review Matt Evans 3 participants 3 messages Apr 15 – Apr 17

Subsystems (2)
KVM VFIO driver
lore
Share & tools
lore

Matt Evans

author
#0 lore raw

PATCH 1/1 vfio/pci: Clean up DMABUFs before disabling function

On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible.

This fixes an issue where, if the function is disabled first, a tiny window exists in which the function's MSE is cleared and yet BARs could still be accessed via the DMABUF. The resources would also be freed and up for grabs by a different driver.

Fixes 5d74781ebc86c ("vfio/pci: Add dma-buf export support for MMIO regions")
Signed-off-by Matt Evans <[email protected]>
Reviewed-by Jason Gunthorpe <[email protected]>

---

Jason,

Added your R-B from https://lore.kernel.org/kvm/[email protected]/

Thanks, Matt

drivers/vfio/pci/vfio_pci_core.c | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/vfio/pci/vfio_pci_core.c +2 -2
index ad52abc46c04..3f8d093aacf8 100644
@@ -734,10 +734,10 @@ void vfio_pci_core_close_device(struct vfio_device *core_vdev)
 #if IS_ENABLED(CONFIG_EEH)
 	eeh_dev_release(vdev->pdev);
 #endif
-	vfio_pci_core_disable(vdev);
-
 	vfio_pci_dma_buf_cleanup(vdev);
 
+	vfio_pci_core_disable(vdev);
+
 	mutex_lock(&vdev->igate);
 	vfio_pci_eventfd_replace_locked(vdev, &vdev->err_trigger, NULL);
 	vfio_pci_eventfd_replace_locked(vdev, &vdev->req_trigger, NULL);
Signature · 1 line
2.47.3
Reviewed-by on v1 1/1
#1 lore raw
Quoted 15 lines · Matt Evans

On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible.

This fixes an issue where, if the function is disabled first, a tiny window exists in which the function's MSE is cleared and yet BARs could still be accessed via the DMABUF. The resources would also be freed and up for grabs by a different driver.

Fixes 5d74781ebc86c ("vfio/pci: Add dma-buf export support for MMIO regions")
Signed-off-by Matt Evans <[email protected]>
Reviewed-by Jason Gunthorpe <[email protected]>

---

Quoted 9 lines

Jason,

Added your R-B from https://lore.kernel.org/kvm/[email protected]/

Thanks, Matt

drivers/vfio/pci/vfio_pci_core.c | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

Thanks,

Reviewed-by Leon Romanovsky <[email protected]>
Reviewed-by on v1 1/1
#2 lore raw
In reply to Matt Evans
Quoted 13 lines

From: Matt Evans <[email protected]>
Sent: Thursday, April 16, 2026 2:18 AM

On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible.

This fixes an issue where, if the function is disabled first, a tiny window exists in which the function's MSE is cleared and yet BARs could still be accessed via the DMABUF. The resources would also be freed and up for grabs by a different driver.

Quoted 4 lines
Fixes 5d74781ebc86c ("vfio/pci: Add dma-buf export support for MMIO

regions")

Signed-off-by Matt Evans <[email protected]>
Reviewed-by Jason Gunthorpe <[email protected]>
Reviewed-by Kevin Tian <[email protected]>