nsm_device_probe() registers an hwrng provider and /dev/nsm.
hwrng_register() can make this the current RNG, and the hwrng fill kthread
finds it through the RCU-protected get_current_rng() rather than under the
rng_mutex that hwrng_register() holds, so it can be in nsm_rng_read()
offering buffers and kicking the queue before probe has returned.

The driver never calls virtio_device_ready(), so DRIVER_OK is set on its
behalf by virtio_dev_probe(), only once probe has returned. The virtio
spec is explicit about that ordering in 3.1 Device Initialization:
  |  The driver MUST NOT send any buffer available notifications to the
  |  device before setting DRIVER_OK.

A device that waits for DRIVER_OK before servicing the queue therefore
leaves that read unanswered.

Set DRIVER_OK once the virtqueue exists and before either interface is
registered, so that the queue is usable by the time anything that can reach
it is published; commit f5866db64f34 ("virtio_console: enable VQs early")
and commit 1d774589f924 ("i2c: virtio: mark device ready before registering
the adapter") do the same for the same reason. The err_hwrng and err_misc
paths then unwind a device that is live, so reset it before deleting the
virtqueue - the core only adds VIRTIO_CONFIG_S_FAILED to the status when
probe fails, it does not reset.

Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver")
Signed-off-by: Jasper Wise <jaspwise@amazon.co.uk>
---
 drivers/misc/nsm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c
index 3960506eb7ab..088f93a8de5f 100644
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -440,6 +440,8 @@ static int nsm_device_probe(struct virtio_device *vdev)
 
 	mutex_init(&nsm->lock);
 
+	virtio_device_ready(vdev);
+
 	/* Register as hwrng provider */
 	nsm->hwrng = (struct hwrng) {
 		.read = nsm_rng_read,
@@ -472,6 +474,7 @@ static int nsm_device_probe(struct virtio_device *vdev)
 err_misc:
 	hwrng_unregister(&nsm->hwrng);
 err_hwrng:
+	virtio_reset_device(vdev);
 	vdev->config->del_vqs(vdev);
 err_init_vq:
 	return rc;

base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
-- 
2.50.1