From nobody Sun Jul 26 12:33:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1781769415; cv=none; d=zohomail.com; s=zohoarc; b=Sa30kMDSRw1XvPFLN4v89m1M+XZOQbeKmnZuawLVPhzzF79ZmnPYAwqpuoul25E4vfRvCH2lv2dbgjwgJXbDkebO0f0W2FHlTbz58VAIlu8xnSZfzihU63sOcCKANbJXYsgA2tIHSBWxQ3so/4k9WZ3rZLpeEf3W0rQN12BsGQY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781769415; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=VyAslQitiUQ2rIN4BzBYGPLKvHsPIFFDEuTAJa/cPn8=; b=N1GWxOzC2MyliFYOEvXPc2ZYewqCmKAUS1GlGLz8KfkwQlidDm1Af+j8nA9wN4uqv2VjqnREbmiP0wjBDc974A4nkUyH58tAalAhUzjbMXf7J7sU6mnkepnUScasDLo8z0NEMj4S8hERWYod6LQ/ehCKzf1ViF0oCqOLZY+3TN8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1781769414638808.1778445909441; Thu, 18 Jun 2026 00:56:54 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wa7cE-0000xh-AE; Thu, 18 Jun 2026 03:56:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wa7c1-0000qZ-NV; Thu, 18 Jun 2026 03:56:33 -0400 Received: from fout-b6-smtp.messagingengine.com ([202.12.124.149]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wa7bz-0005Ry-KE; Thu, 18 Jun 2026 03:56:33 -0400 Received: from phl-compute-12.internal (phl-compute-12.internal [10.202.2.52]) by mailfout.stl.internal (Postfix) with ESMTP id 4BC6A1D0012B; Thu, 18 Jun 2026 03:56:26 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-12.internal (MEProxy); Thu, 18 Jun 2026 03:56:26 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 18 Jun 2026 03:56:23 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=irrelevant.dk; h=cc:cc:content-transfer-encoding:content-type:content-type :date:date:from:from:in-reply-to:message-id:mime-version :reply-to:subject:subject:to:to; s=fm3; t=1781769386; x= 1781855786; bh=VyAslQitiUQ2rIN4BzBYGPLKvHsPIFFDEuTAJa/cPn8=; b=P vaWuxjGGJFA0lyY61DkbWyvlLoQSfhTxuPOzIsQ2VG43kbpnKVKxWHx2y7nayDXS w5oixuuFERW1OhfGZoaPohqVmMq0vPOGOHqA8oOh4h1MJZ7Of3jEfN+HUp0XQndG gRqHd0kb+igfsM+u4hdrmWhtbjnhaHdymf1CFnGFLuUsX7W2GzfBJnHQXnVD79IV Mo+iO3cYy9qKc6GxrZzvtOY3ejcMtZ26J2FLWLnTcFGBUWhZRDH9HqcSvGdrw8xs qpPJHIv2aKcftE06zBoJVbGQyJ8ekniyN5fswR8M70ArQIUEwnNF6QenW5mUwIAx 5KJH0D0qO5Hu2bmGDqxxQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:message-id:mime-version:reply-to:subject :subject:to:to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm1; t=1781769386; x=1781855786; bh=VyAslQitiUQ2rIN4BzBYGPLKvHsP IFFDEuTAJa/cPn8=; b=DBgrqAMXWGxvelpw/9w5u06bjivomv10MPimzf6MHGWc aOcEp9BYWBDSdDB582bPi0PCwSI+u6HiVcbVB+xu9GxZ9V6ye5+L1ZJB1aOXwCka pj4CnWxY8PMB7PsaDpUMSESmZgIKaJx/qL3tBOdMTmIPuKyZwza8wrG43Q2m5waS tO0Bqe7LaOU80tGRLyGXci32qA75J7E8F8hLJG+DP3DQ8uyX9u3qjcRocGv5Cu0Q eFmwThUVDXtYZ924d+w2nR5iZN3vFfPtvvx4Oz/Ks/Wpi5YUwMnMCQdfpYtKiT61 OisaWRDnhBSJwWJgoMQc2BHJvriAJxVl4gQ/NRV80Q== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTEhgopaSph5IhWsLd0nqLfLKpBkeQiClnTD6bh4QSNNgHii3wDJ4Ixoo5WbtP/fpB QohJNpDL2AXp5Nitd11LwGSjcUlY466bV0bYkVXkFk4t6o86BrZ1QHYv/hJuMZBQSAL8Q4 fwacQE7meRcQ54u2+hK9qhwiCIYonZp961lpdTHKLOrtat9MpfwHI8FXSitqgRvGxxC6Nf /G4S8G8Y+Aase+bIslM4lr7ljaQ1JRBxZcPtTFnnbwJGLx6wVrhbFWsdG/t9JUHJP4giwI bmTGYYPQ2egdznPE/RE1cjVcY2DlqIBytJ1dM4jJ6lLiLVj/7tIXd978Vylec/+V1fE3Mm AKgsOynCa+pfudVMxK0ZSjK7Fzd20cCo6lFBsg5L5vAqVUUB06r/RByDsPPnIXH1z4iCZA eEQQ76OnERN8AghlI1SbhvADgquaXERfnRljj3IMNnhSTex3yfVaD2+qitB3CHckbbdsBF ZLyOaXggJJtzqeNK/lwdCmA3G+KMVHucaZ82KXL5lNJkvQIMY2IMHEdRHQcb8J3lrMj5OZ SKJT5+11jH9afg12PgQPnIdCogtDAX3N2o6M83OmgHw8iiS460mgvhHEAplHESorP78fRF pO8oZwpc0kwFOaXhVnXfwuOQtcR6Rl9qSNbaj7UrPGelWhhly9GCiKu+4EoQ X-ME-Proxy: Feedback-ID: idc91472f:Fastmail From: Klaus Jensen Date: Thu, 18 Jun 2026 09:56:18 +0200 Subject: [PATCH] hw/nvme: fix potential use-after-free doing controller reset MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260618-fix-heap-uaf-ctrl-reset-v1-1-806ec08dd951@samsung.com> X-B4-Tracking: v=1; b=H4sIAKGkM2oC/x2MwQqDMBAFf0X27EIM1Kq/Ih7S9aUuiMrGFkH8d 4PHgZk5KcEUibriJMNfk65LhqosSKawfME6ZibvfO3qquGoB08IG/9CZNltZkPCzhLdSz7i8PY t5XozZPU598N13eRkZNZpAAAA X-Change-ID: 20260618-fix-heap-uaf-ctrl-reset-cf05cbc0e729 To: qemu-devel@nongnu.org, Keith Busch , Klaus Jensen , Jesper Devantier , qemu-block@nongnu.org Cc: Klaus Jensen , qemu-stable@nongnu.org, Jia Jia X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=2189; i=k.jensen@samsung.com; h=from:subject:message-id; bh=wmgxcvvWJKufQZBvoOuKnSWXTHeThpUU021XWZliREA=; b=LS0tLS1CRUdJTiBQR1AgTUVTU0FHRS0tLS0tCgpvd0o0bkFGdEFaTCtrQTBEQUFvQlRlR3ZNV zFQRGVrQnl5WmlBR296cEtZZkRjQ2QzakdTZWNvZ2xyRUpSM0EvCndFcWlZZHVmd1NrK3JZcktL QUl3bDRrQk13UUFBUW9BSFJZaEJGSW9NNnAxNHR6bW9rZG13RTNocnpGdFR3M3AKQlFKcU02U21 BQW9KRUUzaHJ6RnRUdzNwS0EwSC8zZjM1SDhQUWhXNkFHbmJaRTRLSUM1WXVsL1E4dVVuVjMwUw pDKzdPQnNvS3JibnZQNENoT3Njd3dJMEhURGV4eGRBU1NVeCszT0VHenZWZEdTaSthZlpjZWg1V VFZeEVyTmd0CndqamRiTFFwZDc5YnZWd0lUcDBTbDdNZDhaQjZYbWxjdkJ0Qm9hRnBqcEI1Rzkw MG1aempybEFNWTdRQVBPUlEKdElLOTBuNjMzeDUvMHJxaDF5bGRpRjRrcmo3WXd4d2pUN2V0dkg wS1cxNnZaUjY3Mlo4dTFzVGN3QUVQL3MyYQp3VklxVWY2VG95WlJUTXhYUUF4REM1Sk9rVWVXdk pnUHhRUEp0bVB6R2J2RzN4TlJ5c3VFanY2TnNxeDdPbjRWCktDZnIxTzVZbFk4K08yYWpIZUpET 29qVEtYMjZKV2tGeFdVZEJETDRQNzVCaUkxeW5xL0MvNlBTCj1Xbng3Ci0tLS0tRU5EIFBHUCBN RVNTQUdFLS0tLS0K X-Developer-Key: i=k.jensen@samsung.com; a=openpgp; fpr=DDCA4D9C9EF931CC3468427263D56FC5E55DA838 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=202.12.124.149; envelope-from=its@irrelevant.dk; helo=fout-b6-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @irrelevant.dk) X-ZM-MESSAGEID: 1781769416510158500 From: Klaus Jensen A controller reset may race with inflight DMA I/O. SQ deletion (when done by the host through the Delete I/O Submission Queue command) handles this, but the controller reset path does not, which may lead to the freeing request resources prior to the DMA completing in certain conditions under large and heavy I/O pressure. Cc: qemu-stable@nongnu.org Reported-by: Jia Jia Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 34 ++++++++++++++++++++++++++++++++-- 1 file changed, 32 insertions(+), 2 deletions(-) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 815f39173c8a..75768272f241 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -7906,10 +7906,40 @@ static void nvme_ctrl_reset(NvmeCtrl *n, NvmeResetT= ype rst) } =20 for (i =3D 0; i < n->params.max_ioqpairs + 1; i++) { - if (n->sq[i] !=3D NULL) { - nvme_free_sq(n->sq[i], n); + NvmeRequest *req, *next; + + NvmeSQueue *sq =3D n->sq[i]; + NvmeCQueue *cq; + + if (!sq) { + continue; } + + /* cancel any outstanding requests */ + while (!QTAILQ_EMPTY(&sq->out_req_list)) { + req =3D QTAILQ_FIRST(&sq->out_req_list); + assert(req->aiocb); + req->status =3D NVME_NO_COMPLETE; + blk_aio_cancel(req->aiocb); + } + + assert(QTAILQ_EMPTY(&sq->out_req_list)); + + cq =3D n->cq[sq->cqid]; + + /* blk_aio_cancel may enqueue completions on the cq; drop them */ + QTAILQ_FOREACH_SAFE(req, &cq->req_list, entry, next) { + if (req->sq !=3D sq) { + continue; + } + + QTAILQ_REMOVE(&cq->req_list, req, entry); + QTAILQ_INSERT_TAIL(&sq->req_list, req, entry); + } + + nvme_free_sq(n->sq[i], n); } + for (i =3D 0; i < n->params.max_ioqpairs + 1; i++) { if (n->cq[i] !=3D NULL) { nvme_free_cq(n->cq[i], n); --- base-commit: c7cf7c810153d6f5f31aa2d5c0dee9087f6b4dff change-id: 20260618-fix-heap-uaf-ctrl-reset-cf05cbc0e729 Best regards, --=20 Klaus Jensen