linux-next.git/drivers/virtio, branch master

virtio: synchronize callbacks after device reset

2026-09-03T20:00:46+00:00

virtio_reset_device says: Note: this guarantees that vq callbacks are not in progress but in practice, only virtio pci correctly synchronizes the cbs. On other transports, a callback that is already executing, keeps running while the driver tears down the state it uses. Move virtio_synchronize_cbs from virtio pci to virtio_reset_device fixing this for all transports that implement synchronize_cbs(). NB: transports without synchronize_cbs are probably still broken. Reported-by: Karl Mehltretter Link: https://lore.kernel.org/all/20260818040433.66986-1-kmehltretter@gmail.com/ Signed-off-by: Michael S. Tsirkin

virtio_pci: return IRQ_HANDLED for INTx interrupts

2026-09-03T20:00:12+00:00

vp_interrupt() returns the result of vp_vring_interrupt(), so a config-change interrupt with no virtqueue work is reported as unhandled on a shared INTx line. To fix, once the ISR read is non-zero, return IRQ_HANDLED. Fixes: 77cf524654a8 ("virtio_pci: split up vp_interrupt") Reported-by: Andrew Stellman Link: https://lore.kernel.org/all/20260407123904.6390-4-astellman@stellman-greene.com/ Signed-off-by: Michael S. Tsirkin

virtio_input: stop callbacks before unregistering input device

2026-09-03T15:25:02+00:00

virtinput_remove() unregisters the input device, which can free it, before resetting the virtio device that can still deliver events. virtinput_recv_events() drops vi->lock around input_event() and samples vi->ready only on loop entry. A callback that has passed that check can therefore use the freed device, requeue a buffer, and kick the queue after reset has begun. A KASAN run with the race window widened reproduced the use-after-free. Reset the device first, as virtinput_freeze() already does. Recheck vi->ready after reacquiring the lock so the callback does not requeue or kick once teardown starts. Fixes: 271c865161c5 ("Add virtio-input driver.") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter Signed-off-by: Michael S. Tsirkin Message-ID: <20260818040433.66986-3-kmehltretter@gmail.com>

virtio_balloon: avoid shrinker execution during PM suspend

2026-09-03T15:24:59+00:00

During PM freeze (e.g. S4 hibernation), virtballoon_freeze() calls remove_common() which resets the virtio device and deletes all virtqueues. However, the balloon shrinker remains registered with core MM. If memory pressure occurs during S4 hibernation image creation/saving, MM invokes virtio_balloon_shrinker_scan(), which attempts to reclaim free pages. Although return_free_pages_to_mm() only frees pages back to MM, reclaiming free pages under memory pressure can trigger page reporting which might access the deleted reporting virtqueue if it is not yet frozen, or interact with other parts of the driver in a teardown state. Avoid this by adding a `suspended` flag to `struct virtio_balloon`. Set this flag to true in virtballoon_freeze() and false in virtballoon_restore(). Check this flag in both shrinker callbacks (scan and count) and return 0 if the device is suspended, preventing any shrinker execution while virtqueues are deleted. Wrap the lockless reads in READ_ONCE() and writes in WRITE_ONCE() to prevent compiler optimization issues and KCSAN data race warnings. Fixes: 71019de8219b ("virtio_balloon: Add free page hinting support") Cc: stable@vger.kernel.org Acked-by: David Rientjes Signed-off-by: Link Lin Signed-off-by: Michael S. Tsirkin Message-ID: <20260717002311.681748-3-linkl@google.com>

virtio_pci_modern: avoid infinite loop in vp_reset() on invalid status

2026-09-03T15:24:58+00:00

vp_reset() polls device_status in a tight loop, waiting for it to read back as 0 after the reset write. device_status is read via MMIO from the common configuration structure, which requires the PCI_COMMAND Memory Space Enable bit to be set. If that bit is cleared while the device is bound -- e.g. by writing 0x0000 to PCI_COMMAND (config space offset 4) -- the MMIO read no longer reaches the device and returns the bus's synthesized all-ones response instead. Since that value can never legitimately clear to 0, the loop spins forever and hangs the caller. Use VIRTIO_STATUS_ERROR() to recognize such values and bail out of the poll loop instead of looping indefinitely. Signed-off-by: Abhin Parekadan Jose Signed-off-by: Michael S. Tsirkin Message-ID: <20260802174059.4082-3-abhinjoses@gmail.com>

virtio_pci_modern_dev: warn once on invalid status

2026-09-03T15:24:58+00:00

vp_modern_get_status() returns the raw device_status byte as read from the common configuration structure (struct virtio_pci_common_cfg, mapped via the VIRTIO_PCI_CAP_COMMON_CFG capability). That byte should only ever contain some combination of the status bits defined by the virtio spec (bits 0-3, 6-7); bits 4 and 5 are reserved and a spec-compliant device must never set them. A value with any other bit set means either the device is violating the spec, or the read never reached real device state at all -- e.g. because a write of 0x0000 to the PCI_COMMAND register (config space offset 4) clears the Memory Space Enable bit, causing the device to stop responding to memory-mapped register accesses -- effectively simulating an unresponsive/removed device without a real hot-unplug. In that case the MMIO read returns the bus's synthesized all-ones response instead of real device state. Add VIRTIO_STATUS_ERROR() to the uapi header to recognize such values, and warn once from vp_modern_get_status() when it sees one, so the bogus status is visible at its source rather than only showing up as confusing behavior in callers. Signed-off-by: Abhin Parekadan Jose Signed-off-by: Michael S. Tsirkin Message-ID: <20260802174059.4082-2-abhinjoses@gmail.com>

virtio-vdpa: Use queue id when setting vq affinity

2026-09-03T15:24:58+00:00

When optional queues are skipped, pass the compressed vDPA queue id to set_vq_affinity() so affinity is applied to the queue that was actually created. Signed-off-by: Xiong Weimin Signed-off-by: Michael S. Tsirkin Message-ID: <20260804092649.1344478-1-xiongweimin@kylinos.cn>

virtio_input: reset device if input_register_device() fails

2026-09-03T15:24:56+00:00

Probe marks the device DRIVER_OK with virtio_device_ready() before calling input_register_device(). If registration fails, the error path cleared vi->ready and called del_vqs() while the device was still live, so the device could keep DMA to queues that were already torn down. Match remove/freeze: call virtio_reset_device() on that path before tearing down the virtqueues. Fixes: 271c865161c5 ("Add virtio-input driver.") Cc: stable@vger.kernel.org Signed-off-by: Xiong Weimin Signed-off-by: Michael S. Tsirkin Message-ID: <20260805032931.1606652-1-xiongweimin@kylinos.cn>

virtio_mmio: disable IRQ wake before free_irq

2026-09-03T15:24:55+00:00

When the DT node has "wakeup-source", vm_find_vqs() calls enable_irq_wake() on the shared IRQ, but vm_del_vqs() freed that IRQ without a matching disable_irq_wake(). That leaves a wake reference behind and can warn on later free_irq()/request_irq() cycles. Record whether enable_irq_wake() succeeded, and disable it in vm_del_vqs() before free_irq(). Fixes: 02213273f72a ("virtio_mmio: add support to set IRQ of a virtio device as wakeup source") Cc: stable@vger.kernel.org Signed-off-by: Xiong Weimin Signed-off-by: Michael S. Tsirkin Message-ID: <20260805032937.1606737-1-xiongweimin@kylinos.cn>

virtio: fix use-after-free in unregister_virtio_device()

2026-09-03T15:24:52+00:00

device_unregister() is device_del() plus put_device(). When the caller holds no extra reference, that drops the last one and runs the release callback, which for several transports frees the memory the embedded struct virtio_device sits in. unregister_virtio_device() then calls virtio_debug_device_exit(), which reads dev->debugfs_dir out of the freed object. Affected transports are the ones whose release callback frees and whose remove path takes no reference: virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo and virtio_ccw. virtio_pci is unaffected because virtio_pci_remove() brackets the call with get_device() and put_device(). Remove the debugfs entries before the device can go away. They are only accessed through the protected debugfs interface, so debugfs_remove_recursive() waits for in-progress file operations before returning. Tearing them down while the device is still alive is therefore safe. Reproduced on User-Mode Linux with CONFIG_KASAN and CONFIG_VIRTIO_DEBUG by unbinding a virtio-uml device: BUG: KASAN: slab-use-after-free in virtio_debug_device_exit+0x36/0x4d Read of size 8 at addr 00000000616e0b10 by task init/1 __asan_report_load8_noabort virtio_debug_device_exit+0x36/0x4d unregister_virtio_device+0x48/0x75 virtio_uml_remove platform_remove device_release_driver_internal unbind_store Freed by task 1: kfree virtio_uml_release_dev device_release kobject_put put_device device_unregister With this applied, the report is gone and unbind is clean. Fixes: 96a8326d69ff ("virtio: add debugfs infrastructure to allow to debug virtio features") Assisted-by: Claude:claude-opus-5 Signed-off-by: Karl Mehltretter Signed-off-by: Michael S. Tsirkin Message-ID: <20260821213953.76906-1-kmehltretter@gmail.com>