In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd shutdown acrn_irqf

In the Linux kernel, the following vulnerability has been resolved:

virt: acrn: Fix irqfd use-after-free during eventfd shutdown

acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free
the same struct hsm_irqfd:

CPU0 CPU1

---

eventfd_release()
wake_up_poll(EPOLLHUP)
hsm_irqfd_wakeup()
queue_work(&irqfd->shutdown)
acrn_irqfd_deassign()
hsm_irqfd_shutdown()
list_del_init()
eventfd_ctx_remove_wait_queue()
eventfd_ctx_put()
kfree(irqfd)
hsm_irqfd_shutdown_work()
container_of(work, ..., shutdown)
irqfd->vm <-- use-after-free

The deassign path freed the irqfd while a shutdown work item was
already queued by EPOLLHUP (or vice versa), so the work item could
resurrect a dangling pointer through container_of().

Switch to the lifetime model used by KVM irqfds:

• Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds
  under irqfds_lock and queue the cleanup work.
• hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the
  eventfd waitqueue entry, drops the eventfd reference and frees the
  irqfd.
• A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()
  ensures the cleanup work is queued at most once, no matter how many
  of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to
  call from the waitqueue callback, which runs with wqh->lock held and
  IRQs disabled and therefore cannot take irqfds_lock.
• acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the
  eventfd is fully detached on return. acrn_irqfd_deinit() deactivates
  every irqfd, flushes the workqueue and only then destroys it, so no
  path can queue_work() onto a torn-down workqueue.
• acrn_irqfd_assign() now installs the eventfd waitqueue entry and
  publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is
  never visible to deassign/deinit before its waitqueue entry is in
  place, and any EPOLLHUP that fires in the assign window queues
  cleanup work that blocks on irqfds_lock until publication is done.