From nobody Sat Jul 25 17:33:40 2026 Received: from mail-ej1-f42.google.com (mail-ej1-f42.google.com [209.85.218.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 21592346E59 for ; Wed, 15 Jul 2026 14:23:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784125434; cv=none; b=IPyoJK8fyMuvim+ngHm3UbH8J3ihWQNAOkdVCbR5ORsreinwvm/kdUHVBI3eZakSSPvhbeO0iZ8holGqzRmSBD/uYip9GVtNVs8q/+Zfj9CpncGyNHT7/AHMsB1jLV88461OXb3A5sc+ALbmNW/15hx/nktQALcWacnxP0vhzYI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784125434; c=relaxed/simple; bh=iLWHG7Z9ifkUCPM3I0W59CT2LgsbHMZPMVoaijdCcg4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FnvkMHGlqFcMkMz7LA/5bjm/6jiwKTtaGbv9lOhPdnigATUvpNYA0k+dZKsNV6IV7E36um4QDGrElgXAgRtHNbyD+7GRIp5aAe7aKiERgX9enIQ8JXH9x5Nn2mY3X+mTChbIyemmfQRvTF3RI7JxKz+LOzTfSv7i6yG6g5cuOn0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=G8Cz0cxB; arc=none smtp.client-ip=209.85.218.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="G8Cz0cxB" Received: by mail-ej1-f42.google.com with SMTP id a640c23a62f3a-c15ea93028dso602258066b.3 for ; Wed, 15 Jul 2026 07:23:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784125429; x=1784730229; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Yo/c4CjAVn9rvKKIkMq0mVxy9jNtcNfgzZTIdJ3Ac40=; b=G8Cz0cxBtjZI0A9OyzvOVe6WaDTjkAUQo2PQl5As98uHjZvBKeIntteGshxapy31iy 5ZzjLZJTHP7I6PfqnmNCtT4CHiRiue/ICKfXltfGJirarB+D3diuhWLL9U3IgI0V7a0Q S39zWowuqHX9asgmkJR3zT1mIkGMrRqGCr8zfqnVFfHl4UL9R31hue5mewjcVqdXOP5p ylwwMF2Ojl9MZ8sO2ju1ItEc+qLoOtClTUYBnOrj5jZcVoA/qc3VY4yJetlC78n6GvCS qIPaVsJ7ycejdCn3BUgIdByHVOfdTbY10v0W642S/+s5OyGQh6ZxXC1ebZWLRqQC71QR +N9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784125429; x=1784730229; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Yo/c4CjAVn9rvKKIkMq0mVxy9jNtcNfgzZTIdJ3Ac40=; b=ncbGM9bTy5iT2WeywQ0fycPv5ELND4A/p3eS7fqOsXvfaEIFSvut7/D9s8b25vNw6t tax9QvxaBwgvyV21nUSpMVcLWN1E+dz4sgLGrK118+JS/Nv6zxWERJpkl696t6uvF4+B yjEPFKZOkWCE4Zd3nmcHX0DJ63F4DRWQcaIbQONrVG60/6DlKlT1W69FRaPem9sGt79H 5tjogDgm6WtqxEYOu80WxlnbYNdQf2lyd5H4nOiYEj/SdhJ5AZo98bGuYU2S4+ALBsb8 JFg7mQ3RNKLitpEpZ0SyB9XMuqMHzTau2tbsaGfYwbcU6IUx0grVVmmp+tIW5gzXgWfz RUmw== X-Forwarded-Encrypted: i=1; AHgh+RrcE+ZTrcPpTUBHBh5ErHRYNsQ+apQQFDg6FL/Ybr76+mpnTRkV9irlQRT1n20zSXMb+A/L5YhRrSq+iJE=@vger.kernel.org X-Gm-Message-State: AOJu0YxVFkeY6BUNim85GG92PCMn3WtdgSfLHLf1Vol8cceR0txY7r/V 5SpakhU6ZPNxTjj5zEHc1cHhz3GCPpALPAuU37JJTyEmhHHSGjqatIBn X-Gm-Gg: AfdE7cmlRSVhp2jnCy6yta8KWaArE7gQjnufugeZ37gbkd90j4vPDGaszqjiJzVlnzQ 7LlbbpvXjLJ4XiIp9vlPuhzzDVKfEfEwbDvmFssROm3/GA4wXaDow0bDoHDbNlwf2/+lTxZifhs SGiJ8eKvONyHADVIcT84oJbrlQuBN29+tRn3li3jQpE+kUJ3zad7+S/9f/WZ348SDlGr95DRShz +bQkmyywpeZpceFDmCV/w8BNwCf25iSMve3nRbeYMolBfL5HPjtSvFTKxewxVlCKZM+ZTFFhnvA 3NYHrdgtBlFC0+FW/g+AKWJGVOYorgo3SzLwnet5n6U9Tcl38X8XYTLx9QaTh1SRuoeuxuaN8sw j4A4NhFIkob16wdspfO9fIPyv9AEmAMbveEkh46MrKtFc48cCLdo/8aoO8wDRdU4ElQFdjPaVx+ K+My2g+ed5nz1fBEtX8Xg0k2KIKsHYUbVTdAVZTj46/BtaZF3Mfkx6fz+cwJAvv5Ogr4pl72YIB 8JI1yHMkq/Y7lk= X-Received: by 2002:a17:907:e1ca:20b0:c16:8933:3501 with SMTP id a640c23a62f3a-c1689334452mr16024566b.42.1784125428901; Wed, 15 Jul 2026 07:23:48 -0700 (PDT) Received: from misharu.home (2a02-a463-a071-0-8f3f-3afb-28f6-19c0.fixed6.kpn.net. [2a02:a463:a071:0:8f3f:3afb:28f6:19c0]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c168744bd40sm38743766b.43.2026.07.15.07.23.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jul 2026 07:23:48 -0700 (PDT) From: Hari Mishal To: Amit Shah , Arnd Bergmann , Greg Kroah-Hartman , Gerd Hoffmann , "Michael S . Tsirkin" , Jason Wang , David Hildenbrand , Henrik Rydberg Cc: Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, linux-input@vger.kernel.org, Hari Mishal Subject: [PATCH 1/4] virtio-mem: validate device-reported block size Date: Wed, 15 Jul 2026 16:22:40 +0200 Message-ID: <20260715142337.22811-2-harimishal1@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260715142337.22811-1-harimishal1@gmail.com> References: <20260715142337.22811-1-harimishal1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The device_block_size read from the virtio-mem config space is used as a divisor and also in ALIGN_DOWN() further down the code path in the driver without further validation. A zero value leads to a division by zero, and a non-power-of-two value corrupts the ALIGN_DOWN() bitmask arithmetic leading to a misreporting of guest usable guest ram, post crash. Reject both at init time instead of trusting the device. Assisted-by: gkh_clanker:t1000 Signed-off-by: Hari Mishal --- drivers/virtio/virtio_mem.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/virtio/virtio_mem.c b/drivers/virtio/virtio_mem.c index 11c441501582..43d12ec7c323 100644 --- a/drivers/virtio/virtio_mem.c +++ b/drivers/virtio/virtio_mem.c @@ -2847,6 +2847,13 @@ static int virtio_mem_init(struct virtio_mem *vm) &vm->plugged_size); virtio_cread_le(vm->vdev, struct virtio_mem_config, block_size, &vm->device_block_size); + if (!vm->device_block_size || + !is_power_of_2(vm->device_block_size)) { + dev_err(&vm->vdev->dev, + "invalid device block size: 0x%llx\n", + (unsigned long long)vm->device_block_size); + return -EINVAL; + } virtio_cread_le(vm->vdev, struct virtio_mem_config, node_id, &node_id); vm->nid =3D virtio_mem_translate_node_id(vm, node_id); --=20 2.43.0 From nobody Sat Jul 25 17:33:40 2026 Received: from mail-ej1-f53.google.com (mail-ej1-f53.google.com [209.85.218.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0537B360EE8 for ; Wed, 15 Jul 2026 14:23:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784125435; cv=none; b=bXhTEuXYaQAIW56RP7Os2bHvcF+p15DY2UqjXsp/3XVi3U26NpY4VzI8KoI71m+3vW+ng4s/7hNuBRtue+SJjyEyuUIjZlWCnN1+gDvSGMMjxj6EeV0XIJmaKIbQyMRA/yPUmUqZgHxRwYueUauk2KGvUBeOorvrn/IblK2epSE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784125435; c=relaxed/simple; bh=p/A+hyd8Czmzv+d6bee7JEW5kyJdrX0FwFb3c+j1AQE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fdbR74FF/Rg2WaGQX2FGtNT2t1nTxdXW2XaP6tqYzxj9/r2m/qAbYSqMjZTPkrLc4fcsEF69XH9t2kfnT3S4Y/s6NeDKyBVgxe8q7030JrmrSdIe8tixNoVOFhaIUAiK2Wx0DI/Cz8rpK25r1A4H0v/vVhM/t8cuFcRaaA3dd8c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SwqwjfgC; arc=none smtp.client-ip=209.85.218.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SwqwjfgC" Received: by mail-ej1-f53.google.com with SMTP id a640c23a62f3a-c12614b81c9so1022576766b.3 for ; Wed, 15 Jul 2026 07:23:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784125430; x=1784730230; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=b3M40eRQW8Z0pMjSw8FZJIlwcW2HMM9RvErrQLP04DY=; b=SwqwjfgCEslbuijNYESdaBK7NoufURfPYcTjbE4T/OjQyYATATQZTStoennxlnpu/9 NEhpZuxqun84aEpeYVohYv2wjELeIsSFDG4Lyi2ROipBHnh2EH10zUx+sIUjlicx373R jF1pgN855yRVW9FSh49u+SfaoWgaK62n/OqKKjxshCdV1DtYk/nWWzdVSXtQ90PAObYn Mstc5Hx8fhI9BQ4aF37Hj55jNYW5Zouz9ru/EVPJElEMqsZbONui8qQB4Wm9Dp1PymRM iS61BQP8tV5COrkfwbiCMvGoFMvcmYVFg2Li7R0KIQVX2LOiowwAi9YcfgU3WqlRXukI jrMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784125430; x=1784730230; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=b3M40eRQW8Z0pMjSw8FZJIlwcW2HMM9RvErrQLP04DY=; b=Qwpqv1T+BkZnLPPu8I1CeFxm8sdeQNh8/sA9sjWSbXlBbSP29B2G1xq7Bv80OO/PkN irrvrPqH2rL4wpVYO+Fm89tgBHnojqM0oRJPTdbZwYUaS6y7UdyWEnXh+HuT7sScMGli 2a4CpH3PfT2fjSAnqokzC+qqNDgHxV00vw3isLQJCMQ2DXmM14rTOSiKb9pOH6LkMqWw QvKqCDdGmFjAJthw2XPFjGPgmpdKgJAjJ1xSdK3cBMMp5TDSMn5TAxg2UvHHCGp3WCQ4 T9wK9hQuhStlg1W430mNr/Wv2kDd9VZ+NlT2I4D5WrhRkgc742gXl3y53SQyghQGs4BT w4mQ== X-Forwarded-Encrypted: i=1; AHgh+Rrovde5xX9iq3QcJujFkVc3fhDcFIpRTdU2WaemBguDxh8hkmJ+5clKKSDST4P8Qs7/lj7S/1ahPxC1Trk=@vger.kernel.org X-Gm-Message-State: AOJu0YzpRdYLUrtuG6jJHVJlblRbSdHqBNQqZTzbiCX4piRWyQcpLjUh EBifD5Le3R+TSc+yH162D87QbDDHh7DrySsXegdJSHv6H2GV0T9TZmwh X-Gm-Gg: AfdE7clctvs+8Cs+nDJwXJUOWpdgQfrZS9HG2ZfxyJPjIQ7kDOAoRjTBbhwXr2YD4wO WfeAspl1QYUAajc8FO4XswZu3T9x1idww2GzjV8QyBGiIbLnEsx+5JYzsmp4AaneC8hrSFY+wnI DyXNknZ3LIBXA0WhsjnGbyMJfH9qWKGcnBtsAeR6gTVjyz6oIX/WIHuR3Npbmf+lCwHsOPunvDs WixyCufyoqBSNiujYR95uQ0jVo8iLxShrbF/vjGXqfcdInx7T+fBDEvffo2jAf7JNk2bpEVtVAd ABaOGmyiUKF6TQqEA9hXCgxEIafy1afEsMvq2DGOSHas+wZwEYQzRZOQMi0kMHB7B10b8rSnHSB B+BoY/gl/FFUjU/xbNBX1I2oJegoK/RNes8DnQgSxDEH53K0ATGeLtA8fICzz1McyOJOE/DkNWe codDTRQJamGuZ9glY+b1ofjCc+OEluv6S2W6uY2BnIeNAUoxoq0eHkx5hE8H772baEBWaWGpxrE /NT X-Received: by 2002:a17:907:d16:b0:c15:bc2d:e938 with SMTP id a640c23a62f3a-c16792a5887mr227159666b.32.1784125429946; Wed, 15 Jul 2026 07:23:49 -0700 (PDT) Received: from misharu.home (2a02-a463-a071-0-8f3f-3afb-28f6-19c0.fixed6.kpn.net. [2a02:a463:a071:0:8f3f:3afb:28f6:19c0]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c168744bd40sm38743766b.43.2026.07.15.07.23.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jul 2026 07:23:49 -0700 (PDT) From: Hari Mishal To: Amit Shah , Arnd Bergmann , Greg Kroah-Hartman , Gerd Hoffmann , "Michael S . Tsirkin" , Jason Wang , David Hildenbrand , Henrik Rydberg Cc: Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, linux-input@vger.kernel.org, Hari Mishal Subject: [PATCH 2/4] virtio_input: validate device-reported multitouch slot count Date: Wed, 15 Jul 2026 16:22:41 +0200 Message-ID: <20260715142337.22811-3-harimishal1@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260715142337.22811-1-harimishal1@gmail.com> References: <20260715142337.22811-1-harimishal1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nslots is derived from the ABS_MT_SLOT maximum reported by the virtio device. A device could report a bogus maximum (e.g. -1) making nslots =3D 0, which input_mt_init_slots() does not reject; it returns success without allocating any slot storage, silently leaving the device registered as multitouch capable with no backing state. Reject non-positive slot counts before calling input_mt_init_slots(). Assisted-by: gkh_clanker:t1000 Signed-off-by: Hari Mishal --- drivers/virtio/virtio_input.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/virtio/virtio_input.c b/drivers/virtio/virtio_input.c index deec24e8e682..2cc19782cdd3 100644 --- a/drivers/virtio/virtio_input.c +++ b/drivers/virtio/virtio_input.c @@ -312,6 +312,10 @@ static int virtinput_probe(struct virtio_device *vdev) =20 if (test_bit(ABS_MT_SLOT, vi->idev->absbit)) { nslots =3D input_abs_get_max(vi->idev, ABS_MT_SLOT) + 1; + if (nslots <=3D 0) { + err =3D -EINVAL; + goto err_mt_init_slots; + } err =3D input_mt_init_slots(vi->idev, nslots, 0); if (err) goto err_mt_init_slots; --=20 2.43.0 From nobody Sat Jul 25 17:33:40 2026 Received: from mail-ej1-f46.google.com (mail-ej1-f46.google.com [209.85.218.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 293B2369D7A for ; Wed, 15 Jul 2026 14:23:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784125436; cv=none; b=LKyfk7zkpi+fssOEDX3vu9z44R6BvVnKnMkrnqy8JEKgOmG6FaRqY8fxtRmzJokZWa3vuXK1HZfVkcnin9fAiWWcTo4FtBGc27Jx9YW88BUnD9+V9zOqZrWJ+YDU6JKNRgDdhvu9Udhhwe3UZmGgpaLA9BD5Qob6zpzegYQ7J0A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784125436; c=relaxed/simple; bh=8X6+CQq3Hs1h/DFamxBzRSZL9Lbvylt2J3qL223C0to=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jPwHx71wIXN0tA08NGg/j6DQajddua7v7HV0+ZSaGjYo5NZ8SMns/rf9/cqdYkB9wVcGR8A0ddK9UHPpKJMybU9muii9j3wVkbD4d+nw3gcqq6ObeYVdkmNZJy9N0JhTYo4ROoCUqBbbFE78ZqNY4EI6d4ZbKDQoTegB566+a0M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Lk5fkXmo; arc=none smtp.client-ip=209.85.218.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Lk5fkXmo" Received: by mail-ej1-f46.google.com with SMTP id a640c23a62f3a-c15e592da74so678066966b.1 for ; Wed, 15 Jul 2026 07:23:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784125431; x=1784730231; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=XBjSAX2B0WW1W8im1PxsWC01gxxXxQM2EqUc+55Cths=; b=Lk5fkXmoW5LTi8DuEXIOIMDhBM+UcNyJmxCi1OlIITLBkw6uFaLNi+UGvKtMwMg3cM +C/HeQuJT1dgkrCZ9+fNuSR5hufGOkmfiMffse7mTPSLNVBRFRO93bP7YP0ty+iiyjMp VK04ONa/+Yn8dCW1AOl2TgR4NaCP3ArDOASC178zRmDkapy0ChTZoFJEKGyW0IU3i3SD jeEAvQugzlutY+lo/rwJ/XCPZp8TL62QggIXq/6zMIVByB6OlMQQSEjm6kyQtJEZgnk/ dtrfVmXHzGh2hEmaFs+pqFl98YFmDZIa8EVeJxXT/rHqx2+Xk3qiQtOKvRJV1by5g67x WGKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784125431; x=1784730231; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=XBjSAX2B0WW1W8im1PxsWC01gxxXxQM2EqUc+55Cths=; b=m6ITfmAjCKzuBMxCmvKV/eaDXnl/3ZWY83EqqOnE3ONHMRRNYK5XKpRbnjoiuUsK9P +cOBn6xt8PP27ouG6kkuWEtlo8jpHQoDceGt8A4floqgUdF2WZF2mJEhwtFPK85hzJaG vnOVzYFSWCEVfTUxtMXF5puGmdVS8Wj8jVEgnoZrU0FnjyuCeBs8afOiMo1oh8jG0Wks 18Eqf3z/Q6cv3Saepp/MxETxaGQjz/hMulE7cvavB6Rop4cG+P8e/CVEnikOX3JXd6/z v2Q75BiTopxxEx7+aEIPd+agckEd//PFMLlVNSK1Po289EYmsO44I4/D8K+Lbsf9jILC 8ujw== X-Forwarded-Encrypted: i=1; AHgh+RqZYkqOv3ikpjvdt5T1VXCKR0Z6vqeOhJ/i/cFt+/xl0LQ3+ZFRnFJNkWfqVvvuvu829eA6kcS90Y2wKKc=@vger.kernel.org X-Gm-Message-State: AOJu0Yy1/Rwq9yG/SmohRqzPICfAFrerVxYf70dXwkJjCyiF1mOE8oXz zSRHeE5n9CBf+TllkkKKvwqd811f7n+OWNU0S7nB9lAHa3IiE0sMuvxo X-Gm-Gg: AfdE7ck5g67j1A4QUm96COvlASRKhYNhpOn3U3sh+1F0VNnh64D8ws7kbErp08PEFo1 EkdifnsTcYP/hbC1XMjVUmKDq7VGfLtsv6PQE0soVarOBOdmJhGKb+xAN7uUGfmWy+xfyxtqTAk krAzMlw++s5AbaLbPOL6ERlQ/cxI/kEXAXggLQQizaRvA62uAaL8AUy/QgmaSV8Be7x0kb4Sco4 zasl0DsLMAj3Sr8UkaLECF7Mla68Bh1uQ+vVmFTG3Unff5o9vpUtAUQ3Izzu8k5SaeSEZqdgyUe ZYd7IrEe43fwRveGNpACRAkErw2rhVmR7KyX1QyV0OE12t+z9cS3vcDobCKuk8lKRD9EHuLtph4 D/0Ekm66YEiJ4ESu+CJAYpLkATJp5UganTXAXY9hYNxP4a/ipedQrmYnSCDX6QfsB1x+gW97C1k p2+UmK470TiMeCvHYdbjtWZkD8D/HyhMx1Eb4XgAxtyRB8zO4UfFhlYorSLK9YktFmUYskINCpu yX4 X-Received: by 2002:a17:907:3e9f:b0:c12:7b74:7812 with SMTP id a640c23a62f3a-c1679533edcmr210683766b.59.1784125431131; Wed, 15 Jul 2026 07:23:51 -0700 (PDT) Received: from misharu.home (2a02-a463-a071-0-8f3f-3afb-28f6-19c0.fixed6.kpn.net. [2a02:a463:a071:0:8f3f:3afb:28f6:19c0]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c168744bd40sm38743766b.43.2026.07.15.07.23.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jul 2026 07:23:50 -0700 (PDT) From: Hari Mishal To: Amit Shah , Arnd Bergmann , Greg Kroah-Hartman , Gerd Hoffmann , "Michael S . Tsirkin" , Jason Wang , David Hildenbrand , Henrik Rydberg Cc: Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, linux-input@vger.kernel.org, Hari Mishal Subject: [PATCH 3/4] virtio_console: avoid NULL portdev dereference in in_intr() Date: Wed, 15 Jul 2026 16:22:42 +0200 Message-ID: <20260715142337.22811-4-harimishal1@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260715142337.22811-1-harimishal1@gmail.com> References: <20260715142337.22811-1-harimishal1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" A port's virtqueue is not torn down immediately if the port itself is hot-unplugged (unplug_port() only nulls port->portdev; the vq callback stays registered until the whole device is removed). If in_intr() fires for a port in that window it dereferences port->portdev->vdev via is_rproc_serial(), crashing on the NULL portdev. Bail out early when portdev has already been cleared. Assisted-by: gkh_clanker:t1000 Signed-off-by: Hari Mishal --- drivers/char/virtio_console.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index 198b97314168..faef362dae85 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -1720,6 +1720,11 @@ static void in_intr(struct virtqueue *vq) } =20 spin_lock_irqsave(&port->inbuf_lock, flags); + if (!port->portdev) { + /* Port is being unplugged, ignore further data. */ + spin_unlock_irqrestore(&port->inbuf_lock, flags); + return; + } port->inbuf =3D get_inbuf(port); =20 /* --=20 2.43.0 From nobody Sat Jul 25 17:33:40 2026 Received: from mail-ed1-f50.google.com (mail-ed1-f50.google.com [209.85.208.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C347F3168EF for ; Wed, 15 Jul 2026 14:23:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784125438; cv=none; b=fl2bFkr9xmRnm6hije5HjZl9EjI4KAXx9geFyKCZ7xsL1+ltDL9V2ul/sz8sZ8TSFuFhkjUea+Vw3CM4929MenVgT86cscQkn0nZv26rp5xP1PudjzIlUJAR4Vkk2Ks9RHCpmk02vUsnpkerjKWW7s7Mr92gFja7j2ziDvXcu58= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784125438; c=relaxed/simple; bh=tWfme+tzQ9G7mAqvSYSvjdoyZ1LogMZJCZU9ph6QRJY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nkQ35oxxouXIGoFNWls9GeK3t2Lu5SnQuvtURUL+FJJM4Xr/l9mwTPpwTKoSpDJAi4pvE8nbZ2sf+cXExxCtwtJCmtRZIAJotcwxL6cAPjcrBQDUhDz0txd/jt+gsMI88HlcV9G2jRKLK5xrqieEKxbZzQCTFcpR4SSugEB/G0Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kAws+HHz; arc=none smtp.client-ip=209.85.208.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kAws+HHz" Received: by mail-ed1-f50.google.com with SMTP id 4fb4d7f45d1cf-69e08ad526cso1551316a12.1 for ; Wed, 15 Jul 2026 07:23:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784125432; x=1784730232; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=gSGPZtrn7btUtmz6wHgzIANbziCZWoxzvDyAbH1+WOo=; b=kAws+HHztRTcyg2oihmMwcDNX7VnDiwdViERgV75b1VZOpIZj3InOlN/wkwkN6vK6v u+UaOcC6BE3OloQeixXBxz9Stl5JsIkgmAUssJgv/Nbn5rB8y/tU7/pUzh2URcH66co9 I4Qz5cJ6mv+8mqgz+gIykIjxtR/ksJCmpErZ6OKnaBl6fpElPv1JqOaYxkfR9KUWVP0y lEVwpP3fb347Dga6lSXoGwm8xss2MmkiiPhajTvbwDQ2qEFoyuNPm3SyE/SLgARYVmVJ znXlgdUz+M0k05HBvrIf3mFSP039xsaM51d8ZCMzHRCfhoCiL9vOW9NLI9h/9Flvd5oN LwTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784125432; x=1784730232; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=gSGPZtrn7btUtmz6wHgzIANbziCZWoxzvDyAbH1+WOo=; b=CSBOPNg3EbobgO9qMEmiMRv7fgof+JGnHbwnPcVj20BKGcqwpkWf9yVDY5CBcWVa2U PUNDVynsszNixrjh/Myur1XwMff977bioGPmM11hNiFkaHq2CiI0SQxgZPFv7bHsb+yE Iv8Bj2k/HuTjx59ma7sQY0XKjdsZJtMkxTkPhKxc+lZiC63/tepDvDPb5ORSJAgLoW6W IbrVFhc8+ljz5TeBrMszrqwlMxCE4GBERs8G2A7scnYLpfHbC+IWRQWseGw34IBsC+1B AyK7rc71xcdX+yEG/EZ1UqCkeWF2imjPqD61iB+R6FWSsvuIY3fLdfOknP+bhKfC8olP b9wA== X-Forwarded-Encrypted: i=1; AHgh+RoNnv1Gt6dTAArm+NGNRYx5XQcrruNYfMnLvBPwtemgIGERpHFdFVXjCbxSrNszvPBW5py6wjZTReriBWg=@vger.kernel.org X-Gm-Message-State: AOJu0YwXlARV47RqYWpIHpLOVHo7MzbzWY5a3dI9uSJgmRJNKVdFbk0w yJ49wSGffwt/ajqjJWusSlHQLosWzyvLyBW97eRRgrJesQow0UqPsFr7hEkFh+YTBVD8vA== X-Gm-Gg: AfdE7cmvqc92nlh/0dOchiWqbpLfoxeEHX/mogFnQHJP4jf5+hhQNNj22Z/7bFCmA1K 5mgfaisWMYONK8dhz1S65jUdLs2vvtj268hnO8hS584o8YphMl4NMCvt8YjoNwpkLUHFkTIMHm5 TZFnJYOOvGcueL1zP9QbtZexUlmeFhsR6aW9mFjwNvPy7BKf2HKEUW9ySlH/Inwu1s2TriN9/iR kTm1eqpnroANLt1DtZw2c0b5dp6Gm4tLyJXYJn8jZ2yKHUEEeL9exKpwowareLWWcpFaokCou/4 aslMy3/XV7Xsc1i1mU8K4xSuChXjdN4NpYkbTwvAoQPQRhYtnqP0Yj90nqHRCTSGNQX+kRoLWeC /5WEjvM00VlZH4N3oL9AGZegcMvnJ2GY3Wt1w2Uh9wigWHZnSPhOVEqrJ4DMEPHFWvNb8aswoq5 FP3FUkjxiP/W/B7FvcM0dL0o8UKkHS9zZq1XWhskt6/v/yrPgIVfgGwKog54s9i9S4VdV8mXz/w +cJ X-Received: by 2002:a17:907:3f96:b0:c15:f26a:3438 with SMTP id a640c23a62f3a-c161ea32e98mr929035366b.24.1784125432269; Wed, 15 Jul 2026 07:23:52 -0700 (PDT) Received: from misharu.home (2a02-a463-a071-0-8f3f-3afb-28f6-19c0.fixed6.kpn.net. [2a02:a463:a071:0:8f3f:3afb:28f6:19c0]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c168744bd40sm38743766b.43.2026.07.15.07.23.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jul 2026 07:23:51 -0700 (PDT) From: Hari Mishal To: Amit Shah , Arnd Bergmann , Greg Kroah-Hartman , Gerd Hoffmann , "Michael S . Tsirkin" , Jason Wang , David Hildenbrand , Henrik Rydberg Cc: Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, linux-input@vger.kernel.org, Hari Mishal Subject: [PATCH 4/4] virtio_console: take a kref in find_port_by_vq() to fix port UAF Date: Wed, 15 Jul 2026 16:22:43 +0200 Message-ID: <20260715142337.22811-5-harimishal1@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260715142337.22811-1-harimishal1@gmail.com> References: <20260715142337.22811-1-harimishal1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" find_port_by_vq() returns a raw struct port pointer without taking a reference on it, unlike find_port_by_devt_in_portdev() which does. find_port_by_vq()'s only two callers, in_intr() and out_intr(), run as virtqueue interrupt callbacks, entirely independent of and possibly concurrently with unplug_port(), which itself runs from a workqueue when the host sends a VIRTIO_CONSOLE_PORT_REMOVE control message. unplug_port() removes the port from portdev->ports under ports_lock, then later drops its last reference with kref_put(), freeing it via remove_port(). find_port_by_vq() also walks portdev->ports under ports_lock, so if it finds the port still on the list, the list removal, and therefore the eventual kref_put(), has not happened yet, and taking a reference at that point is always safe. Without doing so, in_intr()/out_intr() can be left holding a pointer to a port that unplug_port() frees on another core before they are done using it. Both triggers are host-controlled as the host decides when to send the PORT_REMOVE control message and when to kick the port's data vq. So a malicious backend could race the two on purpose, without any guest side cooperation. The freed object is a generic kmalloc allocation containing a wait_queue_head_t, which in_intr()/out_intr() pass to wake_up_interruptible() after touching the stale pointer. wake_up_interruptible() invokes a function pointer read out of the wait queue's entries. If the freed slab slot is reclaimed with attacker influenced content before that call, then this is an arbitrary function call primitive rather than just undefined behaviour. Take a reference in find_port_by_vq() while still holding ports_lock, matching find_port_by_devt_in_portdev(), and release it in in_intr() and out_intr() once they are done with the port. Signed-off-by: Hari Mishal --- drivers/char/virtio_console.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index faef362dae85..1b7593684ed9 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -304,6 +304,11 @@ static struct port *find_port_by_id(struct ports_devic= e *portdev, u32 id) return port; } =20 +/* + * The port object's reference is incremented now and + * it is the caller's responsibility to decrement it + */ + static struct port *find_port_by_vq(struct ports_device *portdev, struct virtqueue *vq) { @@ -312,8 +317,10 @@ static struct port *find_port_by_vq(struct ports_devic= e *portdev, =20 spin_lock_irqsave(&portdev->ports_lock, flags); list_for_each_entry(port, &portdev->ports, list) - if (port->in_vq =3D=3D vq || port->out_vq =3D=3D vq) + if (port->in_vq =3D=3D vq || port->out_vq =3D=3D vq) { + kref_get(&port->kref); goto out; + } port =3D NULL; out: spin_unlock_irqrestore(&portdev->ports_lock, flags); @@ -1706,6 +1713,7 @@ static void out_intr(struct virtqueue *vq) } =20 wake_up_interruptible(&port->waitqueue); + kref_put(&port->kref, remove_port); } =20 static void in_intr(struct virtqueue *vq) @@ -1723,6 +1731,7 @@ static void in_intr(struct virtqueue *vq) if (!port->portdev) { /* Port is being unplugged, ignore further data. */ spin_unlock_irqrestore(&port->inbuf_lock, flags); + kref_put(&port->kref, remove_port); return; } port->inbuf =3D get_inbuf(port); @@ -1756,6 +1765,8 @@ static void in_intr(struct virtqueue *vq) =20 if (is_console_port(port) && hvc_poll(port->cons.hvc)) hvc_kick(); + + kref_put(&port->kref, remove_port); } =20 static void control_intr(struct virtqueue *vq) --=20 2.43.0