From 5d12c51bd98cdb5a32cbfb606963b05740ec42f2 Mon Sep 17 00:00:00 2001 From: Ruoyu Wang Date: Thu, 20 Aug 2026 21:56:03 +0800 Subject: [PATCH 01/13] xen/pcifront: Fix PCI device reference leak in AER handling pci_get_domain_bus_and_slot() increments the reference count of the returned PCI device. pcifront_common_process() drops that reference only when the device or its driver is missing. All paths for a bound device either return directly after invoking an error recovery callback or fall through without calling pci_dev_put(). Consequently, each AER request for a bound device leaks a reference and can keep the device allocated after removal. Declare the looked-up device with __free(pci_dev_put), so every return path releases the reference after callback dispatch. This keeps the device alive while its callback runs and balances the lookup without restructuring the callback returns. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 956a9202cd12 ("xen-pcifront: Xen PCI frontend driver.") Suggested-by: Lukas Wunner Signed-off-by: Ruoyu Wang Reviewed-by: Lukas Wunner Link: https://lore.kernel.org/r/20260813153138.3953222-1-ruoyuw560@gmail.com/ Signed-off-by: Juergen Gross Message-ID: <20260820135603.3901798-1-ruoyuw560@gmail.com> --- drivers/pci/xen-pcifront.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c index cffc32d66032..0dea8a69fa36 100644 --- a/drivers/pci/xen-pcifront.c +++ b/drivers/pci/xen-pcifront.c @@ -579,16 +579,15 @@ static pci_ers_result_t pcifront_common_process(int cmd, int bus = pdev->sh_info->aer_op.bus; int devfn = pdev->sh_info->aer_op.devfn; int domain = pdev->sh_info->aer_op.domain; - struct pci_dev *pcidev; + struct pci_dev *pcidev __free(pci_dev_put) = + pci_get_domain_bus_and_slot(domain, bus, devfn); dev_dbg(&pdev->xdev->dev, "pcifront AER process: cmd %x (bus:%x, devfn%x)", cmd, bus, devfn); - pcidev = pci_get_domain_bus_and_slot(domain, bus, devfn); if (!pcidev || !pcidev->dev.driver) { dev_err(&pdev->xdev->dev, "device or AER driver is NULL\n"); - pci_dev_put(pcidev); return PCI_ERS_RESULT_NONE; } pdrv = to_pci_driver(pcidev->dev.driver); From 9b4df0baa2aa03d22310e59846ca628f7afd4115 Mon Sep 17 00:00:00 2001 From: Gui-Dong Han Date: Thu, 30 Jul 2026 16:40:00 +0800 Subject: [PATCH 02/13] xen/blkback: Prevent missed completion when draining I/O MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit xen_blk_drain_io() sets drain before checking inflight. xen_blkbk_unmap_and_respond_callback() decrements inflight with atomic_dec_and_test() before checking drain. The pre-wait condition check was added to avoid missing a completion, but atomic_set() is unordered. With one I/O in flight, the drain path can set drain to 1 and read inflight as 1 before the completion decrement. The completion path then decrements inflight to 0 but can still read drain as 0. It skips complete(), so the drain path waits until the timeout despite no I/O remaining. Add a full barrier between setting drain and reading inflight. atomic_dec_and_test() already provides full ordering on the completion side. Fixes: 6927d92091df ("xen/blkback: Fix two races in the handling of barrier requests.") Signed-off-by: Gui-Dong Han Acked-by: Roger Pau Monné Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260730084000.3305702-1-hanguidong02@gmail.com> --- drivers/block/xen-blkback/blkback.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c index 7871099bc0d4..88526e349ce1 100644 --- a/drivers/block/xen-blkback/blkback.c +++ b/drivers/block/xen-blkback/blkback.c @@ -1021,6 +1021,13 @@ static void xen_blk_drain_io(struct xen_blkif_ring *ring) struct xen_blkif *blkif = ring->blkif; atomic_set(&blkif->drain, 1); + /* + * Publish drain before checking inflight. Otherwise, + * xen_blkbk_unmap_and_respond_callback() can decrement inflight with + * atomic_dec_and_test() and still see drain == 0 after this path saw + * inflight > 0, missing the completion. + */ + smp_mb(); do { if (atomic_read(&ring->inflight) == 0) break; From f3e27b7955727a4d7c0e9264a2a209fbba788bdc Mon Sep 17 00:00:00 2001 From: Yuchao Zhang Date: Tue, 22 Sep 2026 15:21:55 +0800 Subject: [PATCH 03/13] xen-blkfront: unbind irq before tearing down ring and shadow requests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In blkif_free_ring(), the driver tears down the ring's persistent grants, shadow request arrays, and shared ring structure (xenbus_teardown_ring), and only calls unbind_from_irqhandler() at the very end. While blkif_free_ring() is freeing persistent grants and clearing the shadow array, the event channel interrupt (blkif_interrupt) is still registered and active. If an interrupt arrives from the backend during this teardown window, blkif_interrupt() reads rinfo->ring.sring and, via blkif_completion(), accesses rinfo->shadow[id].grants_used and rinfo->shadow[id].sg. blkif_free_ring() tears these structures down without holding rinfo->ring_lock, and the handler only checks info->connected at entry, so this is a real race resulting in a use-after-free or NULL pointer dereference. Fix this by moving unbind_from_irqhandler() to the beginning of blkif_free_ring(). Calling unbind_from_irqhandler() first frees the IRQ and synchronizes with any in-flight interrupt handlers on other CPUs before ring memory and shadow request structures are deallocated, matching the teardown order in drivers/net/xen-netfront.c. Fixes: 11659569f720 ("xen/blkfront: split per device io_lock") Cc: stable@vger.kernel.org Signed-off-by: Yuchao Zhang Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross Message-ID: <20260922072155.34625-1-ndaugoing@gmail.com> --- drivers/block/xen-blkfront.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c index 8dad7bf5f664..86f5dd3aced1 100644 --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -1210,6 +1210,14 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo) struct blkfront_info *info = rinfo->dev_info; int i, j, segs; + /* + * Interrupt teardown must be done ahead of freeing queue-related + * data, otherwise the interrupt handler can race with the cleanup. + */ + if (rinfo->irq) + unbind_from_irqhandler(rinfo->irq, rinfo); + rinfo->evtchn = rinfo->irq = 0; + /* * Remove indirect pages, this only happens when using indirect * descriptors but not persistent grants @@ -1292,10 +1300,6 @@ static void blkif_free_ring(struct blkfront_ring_info *rinfo) /* Free resources associated with old device channel. */ xenbus_teardown_ring((void **)&rinfo->ring.sring, info->nr_ring_pages, rinfo->ring_ref); - - if (rinfo->irq) - unbind_from_irqhandler(rinfo->irq, rinfo); - rinfo->evtchn = rinfo->irq = 0; } static void blkif_free(struct blkfront_info *info, int suspend) From fe2eea9afbc4727ec972ec8dd4ff1480a5333bab Mon Sep 17 00:00:00 2001 From: Ethan Nelson-Moore Date: Sat, 19 Sep 2026 00:46:43 -0700 Subject: [PATCH 04/13] xen: remove unused hvm_vcpu.h header The header appears to have been unused ever since it was added to the kernel in commit cee2cfb7d18d ("xen/pvh: Import PVH-related Xen public interfaces"). Remove it. Signed-off-by: Ethan Nelson-Moore Reviewed-by: Stefano Stabellini Signed-off-by: Juergen Gross Message-ID: <20260919074650.453007-1-enelsonmoore@gmail.com> --- include/xen/interface/hvm/hvm_vcpu.h | 116 --------------------------- 1 file changed, 116 deletions(-) delete mode 100644 include/xen/interface/hvm/hvm_vcpu.h diff --git a/include/xen/interface/hvm/hvm_vcpu.h b/include/xen/interface/hvm/hvm_vcpu.h deleted file mode 100644 index cbf93493275c..000000000000 --- a/include/xen/interface/hvm/hvm_vcpu.h +++ /dev/null @@ -1,116 +0,0 @@ -/* SPDX-License-Identifier: MIT */ -/* - * Copyright (c) 2015, Roger Pau Monne - */ - -#ifndef __XEN_PUBLIC_HVM_HVM_VCPU_H__ -#define __XEN_PUBLIC_HVM_HVM_VCPU_H__ - -#include "../xen.h" - -struct vcpu_hvm_x86_32 { - uint32_t eax; - uint32_t ecx; - uint32_t edx; - uint32_t ebx; - uint32_t esp; - uint32_t ebp; - uint32_t esi; - uint32_t edi; - uint32_t eip; - uint32_t eflags; - - uint32_t cr0; - uint32_t cr3; - uint32_t cr4; - - uint32_t pad1; - - /* - * EFER should only be used to set the NXE bit (if required) - * when starting a vCPU in 32bit mode with paging enabled or - * to set the LME/LMA bits in order to start the vCPU in - * compatibility mode. - */ - uint64_t efer; - - uint32_t cs_base; - uint32_t ds_base; - uint32_t ss_base; - uint32_t es_base; - uint32_t tr_base; - uint32_t cs_limit; - uint32_t ds_limit; - uint32_t ss_limit; - uint32_t es_limit; - uint32_t tr_limit; - uint16_t cs_ar; - uint16_t ds_ar; - uint16_t ss_ar; - uint16_t es_ar; - uint16_t tr_ar; - - uint16_t pad2[3]; -}; - -/* - * The layout of the _ar fields of the segment registers is the - * following: - * - * Bits [0,3]: type (bits 40-43). - * Bit 4: s (descriptor type, bit 44). - * Bit [5,6]: dpl (descriptor privilege level, bits 45-46). - * Bit 7: p (segment-present, bit 47). - * Bit 8: avl (available for system software, bit 52). - * Bit 9: l (64-bit code segment, bit 53). - * Bit 10: db (meaning depends on the segment, bit 54). - * Bit 11: g (granularity, bit 55) - * Bits [12,15]: unused, must be blank. - * - * A more complete description of the meaning of this fields can be - * obtained from the Intel SDM, Volume 3, section 3.4.5. - */ - -struct vcpu_hvm_x86_64 { - uint64_t rax; - uint64_t rcx; - uint64_t rdx; - uint64_t rbx; - uint64_t rsp; - uint64_t rbp; - uint64_t rsi; - uint64_t rdi; - uint64_t rip; - uint64_t rflags; - - uint64_t cr0; - uint64_t cr3; - uint64_t cr4; - uint64_t efer; - - /* - * Using VCPU_HVM_MODE_64B implies that the vCPU is launched - * directly in long mode, so the cached parts of the segment - * registers get set to match that environment. - * - * If the user wants to launch the vCPU in compatibility mode - * the 32-bit structure should be used instead. - */ -}; - -struct vcpu_hvm_context { -#define VCPU_HVM_MODE_32B 0 /* 32bit fields of the structure will be used. */ -#define VCPU_HVM_MODE_64B 1 /* 64bit fields of the structure will be used. */ - uint32_t mode; - - uint32_t pad; - - /* CPU registers. */ - union { - struct vcpu_hvm_x86_32 x86_32; - struct vcpu_hvm_x86_64 x86_64; - } cpu_regs; -}; -typedef struct vcpu_hvm_context vcpu_hvm_context_t; - -#endif /* __XEN_PUBLIC_HVM_HVM_VCPU_H__ */ From 2176dea8d8c19cb43a9b3651bfa1cb21eab1b31a Mon Sep 17 00:00:00 2001 From: Abdifatah Suruur Date: Wed, 19 Aug 2026 11:42:17 +0300 Subject: [PATCH 05/13] xen/gntdev: prevent private mappings from becoming writable gntdev_mmap() rejects writable private (non-shared) mappings of foreign grant pages, because a private writable mapping takes the COW path on pages that have no proper struct-page backing. However, VM_MAYWRITE is left set, so userspace can map the grant read-only and then upgrade the mapping to writable with mprotect(), hitting the same COW path the check was written to prevent. Clear VM_MAYWRITE for private mappings, as i915 does for its read-only objects and as fixed in drm/vc4 (CVE-2026-68445) and drm/panthor (CVE-2024-53071) and ptp: vmclock (commit a5edadbae57e2298a56cf7a4e774a027905a331f). Fixes: ab31523c2fcac ("xen/gntdev: allow usermode to map granted pages") Cc: stable@vger.kernel.org Signed-off-by: Abdifatah Suruur Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260819084217.1577-1-suruurism@gmail.com> --- drivers/xen/gntdev.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c index 1dcc4675580e..b71f5bae25b6 100644 --- a/drivers/xen/gntdev.c +++ b/drivers/xen/gntdev.c @@ -1066,6 +1066,13 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) if ((vma->vm_flags & VM_WRITE) && !(vma->vm_flags & VM_SHARED)) return -EINVAL; + /* + * Private mappings of foreign grant pages must never become + * writable: they would take the COW path on granted pages. + */ + if (!(vma->vm_flags & VM_SHARED)) + vm_flags_clear(vma, VM_MAYWRITE); + pr_debug("map %d+%d at %lx (pgoff %lx)\n", index, count, vma->vm_start, vma->vm_pgoff); From 71d59fc2a5e357ac03bb2ee1522a7c1f8bd0c34f Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Mon, 7 Sep 2026 12:05:31 +0530 Subject: [PATCH 06/13] xen: fix typos in comments Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Reviewed-by: Frediano Ziglio Signed-off-by: Juergen Gross Message-ID: <20260907063531.23981-1-hemanth.selam@gmail.com> --- drivers/scsi/xen-scsifront.c | 2 +- drivers/xen/mcelog.c | 2 +- include/xen/interface/platform.h | 4 ++-- include/xen/interface/xen.h | 2 +- include/xen/xenbus.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/xen-scsifront.c b/drivers/scsi/xen-scsifront.c index 989bcaee42ca..f86a47056ea8 100644 --- a/drivers/scsi/xen-scsifront.c +++ b/drivers/scsi/xen-scsifront.c @@ -1076,7 +1076,7 @@ static void scsifront_do_lun_hotplug(struct vscsifrnt_info *info, int op) /* * Front device state path, used in sdev_configure called - * on successfull scsi_add_device, and in sdev_destroy called + * on successful scsi_add_device, and in sdev_destroy called * on remove of a device. */ snprintf(info->dev_state_path, sizeof(info->dev_state_path), diff --git a/drivers/xen/mcelog.c b/drivers/xen/mcelog.c index 32ab419bb503..f19cc7a67f36 100644 --- a/drivers/xen/mcelog.c +++ b/drivers/xen/mcelog.c @@ -1,6 +1,6 @@ /****************************************************************************** * mcelog.c - * Driver for receiving and transferring machine check error infomation + * Driver for receiving and transferring machine check error information * * Copyright (c) 2012 Intel Corporation * Author: Liu, Jinsong diff --git a/include/xen/interface/platform.h b/include/xen/interface/platform.h index 79a443c65ea9..462e36392a9f 100644 --- a/include/xen/interface/platform.h +++ b/include/xen/interface/platform.h @@ -421,10 +421,10 @@ struct xenpf_pcpuinfo { /* IN */ uint32_t xen_cpuid; /* OUT */ - /* The maxium cpu_id that is present */ + /* The maximum cpu_id that is present */ uint32_t max_present; #define XEN_PCPU_FLAGS_ONLINE 1 - /* Correponding xen_cpuid is not present*/ + /* Corresponding xen_cpuid is not present*/ #define XEN_PCPU_FLAGS_INVALID 2 uint32_t flags; uint32_t apic_id; diff --git a/include/xen/interface/xen.h b/include/xen/interface/xen.h index 40c9793e9880..f9acb21875cf 100644 --- a/include/xen/interface/xen.h +++ b/include/xen/interface/xen.h @@ -94,7 +94,7 @@ #define VIRQ_XENOPROF 7 /* V. XenOprofile interrupt: new sample available */ #define VIRQ_CON_RING 8 /* G. (DOM0) Bytes received on console */ #define VIRQ_PCPU_STATE 9 /* G. (DOM0) PCPU state changed */ -#define VIRQ_MEM_EVENT 10 /* G. (DOM0) A memory event has occured */ +#define VIRQ_MEM_EVENT 10 /* G. (DOM0) A memory event has occurred */ #define VIRQ_XC_RESERVED 11 /* G. Reserved for XenClient */ #define VIRQ_ENOMEM 12 /* G. (DOM0) Low on heap memory */ #define VIRQ_XENPMU 13 /* PMC interrupt */ diff --git a/include/xen/xenbus.h b/include/xen/xenbus.h index 8ca15743af7f..6424c5cf8ef5 100644 --- a/include/xen/xenbus.h +++ b/include/xen/xenbus.h @@ -63,7 +63,7 @@ struct xenbus_watch unsigned int nr_pending; /* - * Called just before enqueing new event while a spinlock is held. + * Called just before enqueuing new event while a spinlock is held. * The event will be discarded if this callback returns false. */ bool (*will_handle)(struct xenbus_watch *, From 992df081bc8878d11e1eb5ae4a609910fd35c62b Mon Sep 17 00:00:00 2001 From: Yehyeong Lee Date: Mon, 5 Oct 2026 21:35:54 +0900 Subject: [PATCH 07/13] xen/scsifront: check for a NULL shadow entry on a backend response scsifront_do_response() validates the rqid in a backend response against VSCSIIF_MAX_REQS before using it to index info->shadow[], but then dereferences the entry to test ->inflight without checking that the slot is populated. Shadow slots are NULL before a command is submitted (the host private area is zeroed at allocation) and are reset to NULL in _scsifront_put_rqid() once a request completes, so an in-range rqid that does not correspond to an outstanding request makes the frontend dereference a NULL pointer. A malicious or buggy backend can thus crash the guest by returning a response whose rqid is in range but not in flight -- for example a spurious response before any command has been issued, or a duplicate of one already completed. The ring has only VSCSIIF_MAX_REQS (16) slots, so before the first command every in-range rqid selects a NULL slot. Reject a response whose shadow slot is not populated. Fixes: 6d1c2f48f3fc ("xen/scsifront: harden driver against malicious backend") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20261005123555.253995-1-yhlee@isslab.korea.ac.kr> --- drivers/scsi/xen-scsifront.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/xen-scsifront.c b/drivers/scsi/xen-scsifront.c index f86a47056ea8..9d7e12e40089 100644 --- a/drivers/scsi/xen-scsifront.c +++ b/drivers/scsi/xen-scsifront.c @@ -367,6 +367,7 @@ static void scsifront_do_response(struct vscsifrnt_info *info, struct vscsifrnt_shadow *shadow; if (ring_rsp->rqid >= VSCSIIF_MAX_REQS || + !info->shadow[ring_rsp->rqid] || !info->shadow[ring_rsp->rqid]->inflight) { scsifront_set_error(info, "illegal rqid returned by backend!"); return; From 908019e5999161ca89da310c05ddbf7fc89c129e Mon Sep 17 00:00:00 2001 From: Koichiro Den Date: Fri, 21 Aug 2026 17:41:12 +0900 Subject: [PATCH 08/13] xen/privcmd: Only claim ioreqs matching an ioeventfd The ioeventfd handler shares its event channel with the userspace device model. It must only claim requests that match a registered ioeventfd. Other requests are left for userspace. ioeventfd_interrupt() currently marks every MMIO write INPROCESS before looking for a match. For an unmatched request it drops the lock and restores READY. Userspace may see INPROCESS and skip it. Restoring READY does not send another notification. If userspace handles the request at the same time, the READY store may overwrite its state. Find a matching ioeventfd before changing the request state. The lock now protects only the ioeventfd list. Use explicit virt_*mb() barriers for the ioreq shared with Xen. Fixes: f0d7db7b3324 ("xen: privcmd: Add support for ioeventfd") Cc: stable@vger.kernel.org Signed-off-by: Koichiro Den Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260821084112.2374949-1-den@valinux.co.jp> --- drivers/xen/privcmd.c | 47 +++++++++++++++++-------------------------- 1 file changed, 18 insertions(+), 29 deletions(-) diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c index 7cfc28f1bb86..c67ec6d282cf 100644 --- a/drivers/xen/privcmd.c +++ b/drivers/xen/privcmd.c @@ -1169,51 +1169,40 @@ static irqreturn_t ioeventfd_interrupt(int irq, void *dev_id) struct privcmd_kernel_ioreq *kioreq = port->kioreq; struct ioreq *ioreq = &kioreq->ioreq[port->vcpu]; struct privcmd_kernel_ioeventfd *kioeventfd; - unsigned int state = STATE_IOREQ_READY; + bool matched = false; - if (ioreq->state != STATE_IOREQ_READY || - ioreq->type != IOREQ_TYPE_COPY || ioreq->dir != IOREQ_WRITE) + if (ioreq->state != STATE_IOREQ_READY) return IRQ_NONE; - /* - * We need a barrier, smp_mb(), here to ensure reads are finished before - * `state` is updated. Since the lock implementation ensures that - * appropriate barrier will be added anyway, we can avoid adding - * explicit barrier here. - * - * Ideally we don't need to update `state` within the locks, but we do - * that here to avoid adding explicit barrier. - */ + /* Xen publishes the request before changing its state to READY. */ + virt_rmb(); + + if (ioreq->type != IOREQ_TYPE_COPY || ioreq->dir != IOREQ_WRITE) + return IRQ_NONE; spin_lock(&kioreq->lock); - ioreq->state = STATE_IOREQ_INPROCESS; - list_for_each_entry(kioeventfd, &kioreq->ioeventfds, list) { if (ioreq->addr == kioeventfd->addr + VIRTIO_MMIO_QUEUE_NOTIFY && ioreq->size == kioeventfd->addr_len && (ioreq->data & QUEUE_NOTIFY_VQ_MASK) == kioeventfd->vq) { + /* Finish reading the request before claiming it. */ + virt_mb(); + ioreq->state = STATE_IOREQ_INPROCESS; eventfd_signal(kioeventfd->eventfd); - state = STATE_IORESP_READY; + matched = true; break; } } spin_unlock(&kioreq->lock); - /* - * We need a barrier, smp_mb(), here to ensure writes are finished - * before `state` is updated. Since the lock implementation ensures that - * appropriate barrier will be added anyway, we can avoid adding - * explicit barrier here. - */ + if (!matched) + return IRQ_NONE; - ioreq->state = state; - - if (state == STATE_IORESP_READY) { - notify_remote_via_evtchn(port->port); - return IRQ_HANDLED; - } - - return IRQ_NONE; + /* Publish the response only after signaling the eventfd. */ + virt_wmb(); + ioreq->state = STATE_IORESP_READY; + notify_remote_via_evtchn(port->port); + return IRQ_HANDLED; } static void ioreq_free(struct privcmd_kernel_ioreq *kioreq) From fcc43d1d6bf5fbd41e1e308b17187f9b759df56a Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Thu, 8 Oct 2026 11:48:35 +0200 Subject: [PATCH 09/13] x86/PVH: don't truncate initrd address/size Consuming merely the lower halves of the provided values isn't very useful. (While generally loaders try to place it below 4G, especially when it's huge it may not fit there.) Fixes: 7243b93345f7 ("xen/pvh: Bootstrap PVH guest") Signed-off-by: Jan Beulich Reviewed-by: Jason Andryuk Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <9698d810-6664-4a9d-a847-18ad124261e0@suse.com> --- arch/x86/platform/pvh/enlighten.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/platform/pvh/enlighten.c b/arch/x86/platform/pvh/enlighten.c index f2053cbe9b0c..9be83990cf15 100644 --- a/arch/x86/platform/pvh/enlighten.c +++ b/arch/x86/platform/pvh/enlighten.c @@ -78,7 +78,9 @@ static void __init init_pvh_bootparams(bool xen_guest) struct hvm_modlist_entry *modaddr = __va(pvh_start_info.modlist_paddr); pvh_bootparams.hdr.ramdisk_image = modaddr->paddr; + pvh_bootparams.ext_ramdisk_image = modaddr->paddr >> 32; pvh_bootparams.hdr.ramdisk_size = modaddr->size; + pvh_bootparams.ext_ramdisk_size = modaddr->size >> 32; } /* From 6f165abe2b40ede71c98956cd74cd17c18505e75 Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Wed, 16 Sep 2026 17:09:56 +0000 Subject: [PATCH 10/13] xen/gntdev: Fix gntdev_dmabuf ref leak in dmabuf_exp_wait_released() dmabuf_exp_wait_released() takes a reference on the exported gntdev_dmabuf with dmabuf_exp_wait_obj_get_dmabuf() and passes it to dmabuf_exp_wait_obj_new(), which drops that reference after adding the wait object to the wait list. When the wait object allocation fails, dmabuf_exp_wait_obj_new() returns ERR_PTR(-ENOMEM) early and the reference is never dropped, leaking a reference to the exported gntdev_dmabuf. Drop the reference on the allocation failure path so the reference is consumed whether the wait object is created or not. Fixes: 932d6562179e ("xen/gntdev: Add initial support for dma-buf UAPI") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20260916170956.2086505-1-vulab@iscas.ac.cn> --- drivers/xen/gntdev-dmabuf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c index 83b0df460894..df1883aca850 100644 --- a/drivers/xen/gntdev-dmabuf.c +++ b/drivers/xen/gntdev-dmabuf.c @@ -96,8 +96,10 @@ dmabuf_exp_wait_obj_new(struct gntdev_dmabuf_priv *priv, struct gntdev_dmabuf_wait_obj *obj; obj = kzalloc_obj(*obj); - if (!obj) + if (!obj) { + kref_put(&gntdev_dmabuf->u.exp.refcount, dmabuf_exp_release); return ERR_PTR(-ENOMEM); + } init_completion(&obj->completion); obj->gntdev_dmabuf = gntdev_dmabuf; From 3b4854b69ee70fffb2fa7acac09e715a7efcbae1 Mon Sep 17 00:00:00 2001 From: Yehyeong Lee Date: Tue, 6 Oct 2026 11:34:43 +0900 Subject: [PATCH 11/13] xen/pcifront: check that an AER callback exists before calling it pcifront_common_process() handles an AER request from the backend by dispatching on aer_op.cmd to the bound driver's PCI error handler. It only checks that err_handler and err_handler->error_detected are present, then for the mmio_enabled, slot_reset and resume commands it calls the corresponding callback unconditionally. Those three callbacks are optional -- the PCI core NULL-checks each of them individually before use -- and many drivers (for example igb, igc, ice and ixgbevf) install error_detected without all of them. aer_op.cmd comes from the shared ring, so a malicious or buggy backend can send XEN_PCI_OP_aer_mmio (or _slotreset/_resume) for a device whose driver leaves that callback NULL and make the frontend call through a NULL pointer, crashing the guest. Check each callback before calling it. When mmio_enabled or slot_reset is absent, return PCI_ERS_RESULT_RECOVERED so recovery proceeds, as the PCI core does for a missing callback; returning PCI_ERS_RESULT_NONE would instead make xen-pciback tear the guest domain down. Fixes: 956a9202cd12 ("xen-pcifront: Xen PCI frontend driver.") Cc: stable@vger.kernel.org Signed-off-by: Yehyeong Lee Reviewed-by: Juergen Gross Acked-by: Bjorn Helgaas Signed-off-by: Juergen Gross Message-ID: <20261006023443.338194-1-yhlee@isslab.korea.ac.kr> --- drivers/pci/xen-pcifront.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c index 0dea8a69fa36..b8f2921cc253 100644 --- a/drivers/pci/xen-pcifront.c +++ b/drivers/pci/xen-pcifront.c @@ -598,11 +598,16 @@ static pci_ers_result_t pcifront_common_process(int cmd, case XEN_PCI_OP_aer_detected: return pdrv->err_handler->error_detected(pcidev, state); case XEN_PCI_OP_aer_mmio: - return pdrv->err_handler->mmio_enabled(pcidev); + if (pdrv->err_handler->mmio_enabled) + return pdrv->err_handler->mmio_enabled(pcidev); + return PCI_ERS_RESULT_RECOVERED; case XEN_PCI_OP_aer_slotreset: - return pdrv->err_handler->slot_reset(pcidev); + if (pdrv->err_handler->slot_reset) + return pdrv->err_handler->slot_reset(pcidev); + return PCI_ERS_RESULT_RECOVERED; case XEN_PCI_OP_aer_resume: - pdrv->err_handler->resume(pcidev); + if (pdrv->err_handler->resume) + pdrv->err_handler->resume(pcidev); return PCI_ERS_RESULT_NONE; default: dev_err(&pdev->xdev->dev, From cfaf31becde901f7a2376d36db628f8be0bc7283 Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Wed, 16 Sep 2026 17:11:41 +0000 Subject: [PATCH 12/13] xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf() pcistub_get_gsi_from_sbdf() obtains the stub device with pcistub_device_find(), which returns it with its kref incremented, and returns psdev->gsi without dropping that reference again. The caller cannot release it either, so every lookup leaks one reference to the stub device. Release the reference after reading gsi. Fixes: 2fae6bb7be32 ("xen/privcmd: Add new syscall to get gsi from dev") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Reviewed-by: Juergen Gross Reviewed-by: Jiqian Chen Signed-off-by: Juergen Gross Message-ID: <20260916171141.2086627-1-vulab@iscas.ac.cn> --- drivers/xen/xen-pciback/pci_stub.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c index 79a2b5dfd694..d1a335233aab 100644 --- a/drivers/xen/xen-pciback/pci_stub.c +++ b/drivers/xen/xen-pciback/pci_stub.c @@ -234,13 +234,16 @@ static int pcistub_get_gsi_from_sbdf(unsigned int sbdf) int bus = PCI_BUS_NUM(sbdf); int slot = PCI_SLOT(sbdf); int func = PCI_FUNC(sbdf); + int gsi; psdev = pcistub_device_find(domain, bus, slot, func); - if (!psdev) return -ENODEV; - return psdev->gsi; + gsi = psdev->gsi; + pcistub_device_put(psdev); + + return gsi; } #endif From 61b6d1df1d6234c38a6ea7e4f58e7da035ef6ab4 Mon Sep 17 00:00:00 2001 From: Ross Lagerwall Date: Tue, 6 Oct 2026 17:34:07 +0100 Subject: [PATCH 13/13] xen-blkfront: Fix IO race during unplug MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit During unplug, blkfront stops the hw queues and marks the disk as dead, then later during removal calls del_gendisk(). However, IO issued after the hw queues are stopped but before the call to del_gendisk() will be queued but never handled. This causes del_gendisk() to hang forever waiting for the queue refcount to drop to zero. This can be reproduced by issuing IO during an artificial delay after stopping the hw queues. Fix this by simply not stopping the hw queues directly. Marking the disk as dead already freezes the queue which prevents new requests being added and it synchronously runs the hw queues to clear anything pending. If the hw queues are stopped when calling blk_mark_disk_dead(), running the hw queues is a no-op and can leave queued requests unprocessed. Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Ross Lagerwall Acked-by: Roger Pau Monné Signed-off-by: Juergen Gross Message-ID: <20261006163411.2583538-1-ross.lagerwall@citrix.com> --- drivers/block/xen-blkfront.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c index 86f5dd3aced1..ad0cb42c1019 100644 --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -2142,10 +2142,8 @@ static void blkfront_closing(struct blkfront_info *info) return; /* No more blkif_request(). */ - if (info->rq && info->gd) { - blk_mq_stop_hw_queues(info->rq); + if (info->gd) blk_mark_disk_dead(info->gd); - } for_each_rinfo(info, rinfo, i) { /* No more gnttab callback work. */