github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-19 09:08:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
185a4caeec
linux/net/vmw_vsock
History
Weiming Shi a31e0ad444 vsock/virtio: avoid refilling the RX queue after teardown 
Commit b917507e5a ("vsock/virtio: stop workers during the .remove()")
made the RX worker jump to its common exit when rx_run is clear.  That
exit still refills the RX queue when the buffer count is low, so work
queued across virtio_vsock_vqs_del() can add buffers after the virtqueues
have been deleted.

BUG: KASAN: slab-use-after-free in virtqueue_add_sgs
Read of size 4 by task kworker/0:1
Workqueue: virtio_vsock virtio_transport_rx_work
Call Trace:
 virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2796)
 virtio_vsock_rx_fill (net/vmw_vsock/virtio_transport.c:332)
 virtio_transport_rx_work (net/vmw_vsock/virtio_transport.c:701)
 process_one_work (kernel/workqueue.c:3314)
 worker_thread (kernel/workqueue.c:3478)
 kthread (kernel/kthread.c:436)
 ret_from_fork (arch/x86/kernel/process.c:158)
 ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
...
Freed by task 141:
 kfree (mm/slub.c:6566)
 vp_del_vq (drivers/virtio/virtio_pci_common.c:259)
 vp_del_vqs (drivers/virtio/virtio_pci_common.c:285)
 virtio_vsock_freeze (net/vmw_vsock/virtio_transport.c:912)
 virtio_device_freeze (drivers/virtio/virtio.c:658)
 virtio_pci_freeze (drivers/virtio/virtio_pci_common.c:601)
 pci_pm_freeze (drivers/pci/pci-driver.c:1098)
 device_suspend (drivers/base/power/main.c:1968)
Kernel panic - not syncing: KASAN: panic_on_warn set ...

Jump to a no-refill exit when rx_run is clear, leaving the normal exit
to replenish a running queue.

Fixes: b917507e5a ("vsock/virtio: stop workers during the .remove()")
Cc: stable@vger.kernel.org
Reported-by: Xiang Mei <xmei5@asu.edu>
Link: https://lore.kernel.org/r/20260727035804.1860862-1-bestswngs@gmail.com
Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/f9c8c1d64cad9d262f305d02ffe164c2f900fadf.1785352330.git.bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-03 16:28:58 -07:00
..
af_vsock_tap.c
af_vsock.c vsock: fold sk_acceptq_removed() into vsock_remove_pending() 2026-06-13 10:39:26 -07:00
diag.c sock_diag: add module pointer to "struct sock_diag_handler" 2024-01-23 15:13:54 +01:00
hyperv_transport.c vsock: fold sk_acceptq_added() into vsock_enqueue_accept() 2026-06-13 10:38:28 -07:00
Kconfig Drivers: hv: Add CONFIG_HYPERV_VMBUS option 2025-10-01 00:00:42 +00:00
Makefile vsock: support sockmap 2023-03-29 08:19:38 +01:00
virtio_transport_common.c vsock/virtio: collapse receive queue under memory pressure 2026-07-21 12:11:06 +02:00
virtio_transport.c vsock/virtio: avoid refilling the RX queue after teardown 2026-08-03 16:28:58 -07:00
vmci_transport_notify_qstate.c vmci/vsock: check SO_RCVLOWAT before wake up reader 2022-08-23 10:43:12 +02:00
vmci_transport_notify.c vmci/vsock: check SO_RCVLOWAT before wake up reader 2022-08-23 10:43:12 +02:00
vmci_transport_notify.h vsock: remove include/linux/vm_sockets.h file 2019-11-14 18:12:17 -08:00
vmci_transport.c vsock: fold sk_acceptq_removed() into vsock_remove_pending() 2026-06-13 10:39:26 -07:00
vmci_transport.h vsock: Remove unused function declarations 2023-07-31 14:41:08 -07:00
vsock_addr.c net: Convert proto_ops connect() callbacks to use sockaddr_unsized 2025-11-04 19:10:32 -08:00
vsock_bpf.c net: remove addr_len argument of recvmsg() handlers 2026-03-02 18:17:17 -08:00
vsock_loopback.c vsock: add netns support to virtio transports 2026-01-27 10:45:38 +01:00