From e15596e84c818a2b727d2a7cf742a29331e44c43 Mon Sep 17 00:00:00 2001 From: Jasper Wise Date: Thu, 13 Aug 2026 08:37:52 +0000 Subject: [PATCH] misc: nsm: mark device ready before registering the hwrng and misc device nsm_device_probe() registers an hwrng provider and /dev/nsm. hwrng_register() can make this the current RNG, and the hwrng fill kthread finds it through the RCU-protected get_current_rng() rather than under the rng_mutex that hwrng_register() holds, so it can be in nsm_rng_read() offering buffers and kicking the queue before probe has returned. The driver never calls virtio_device_ready(), so DRIVER_OK is set on its behalf by virtio_dev_probe(), only once probe has returned. The virtio spec is explicit about that ordering in 3.1 Device Initialization: | The driver MUST NOT send any buffer available notifications to the | device before setting DRIVER_OK. A device that waits for DRIVER_OK before servicing the queue therefore leaves that read unanswered. Set DRIVER_OK once the virtqueue exists and before either interface is registered, so that the queue is usable by the time anything that can reach it is published; commit f5866db64f34 ("virtio_console: enable VQs early") and commit 1d774589f924 ("i2c: virtio: mark device ready before registering the adapter") do the same for the same reason. The err_hwrng and err_misc paths then unwind a device that is live, so reset it before deleting the virtqueue - the core only adds VIRTIO_CONFIG_S_FAILED to the status when probe fails, it does not reset. Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver") Signed-off-by: Jasper Wise Link: https://patch.msgid.link/20260813083752.581981-1-jaspwise@amazon.co.uk Signed-off-by: Greg Kroah-Hartman --- drivers/misc/nsm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c index a3a9f9bfc6b7..f1bdde2b77e1 100644 --- a/drivers/misc/nsm.c +++ b/drivers/misc/nsm.c @@ -439,6 +439,8 @@ static int nsm_device_probe(struct virtio_device *vdev) mutex_init(&nsm->lock); + virtio_device_ready(vdev); + /* Register as hwrng provider */ nsm->hwrng = (struct hwrng) { .read = nsm_rng_read, @@ -471,6 +473,7 @@ static int nsm_device_probe(struct virtio_device *vdev) err_misc: hwrng_unregister(&nsm->hwrng); err_hwrng: + virtio_reset_device(vdev); vdev->config->del_vqs(vdev); err_init_vq: return rc;