From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 63F924B7A2D; Thu, 17 Sep 2026 15:42:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789659735; cv=none; b=SlMNrCxaGR3xGnvsZ4Rgpc0xQ1yj5SAIYKPqRUUzb7Ndp8xzmWwpYunAYbvCpVW/IIxc5gwh1gQfAsOBgopMEAD+XAak4yTQ+Ys/E3sCFEYUkejuT5AxTJUzrk0d005mXeBgOc32NUYyxjmbqnywY3G7Pu3bNIg6nW29lbyffks= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789659735; c=relaxed/simple; bh=XXam+p6fp8iN+ktEuc0QDYg56lPmWPpPVhIDwhHKhIM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=l79p0QdnDN4bQDc/YRZoCdqZ5RxnWAzswI7Jxhx6kfyPky1dz+OB0kGssW0ZR9zqfSymqRcNmYhbcL7g4duruHxNZYulmPH3JTKqw5t14nrEhLO+GTCsu/jWxsZJKNii4Z0AxUoMtJSlLAIwsHqty2xXgMOUKUAN+83X2wI9MjY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YDlgEH9/; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="YDlgEH9/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A05941F00893; Thu, 17 Sep 2026 15:42:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789659726; bh=767kEPxmWnq24qCTsjzM2cezE1RYNEZeX5OWoJ4Yp8k=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=YDlgEH9/FD1xoD124hGdLPZV/awXzsiu5wTi4rN+pFer9794j1qI03ZCndVCzEiTt kxFmURcXR55Vnv96QEseeTAvpiLqCYUENn6TmOL58T/JP2hQIZNZNnLh4QM0mVUswQ 0lqutKpF31h4TWxT3NLLvBRabjbMerjyIB4aq6Qo= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Karl Mehltretter , "Michael S. Tsirkin" , Sasha Levin Subject: [PATCH 7.2 353/733] virtio_input: stop callbacks before unregistering input device Date: Thu, 17 Sep 2026 16:11:01 +0100 Message-ID: <20260917151400.380383176@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260917151350.597953846@linuxfoundation.org> References: <20260917151350.597953846@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: Karl Mehltretter [ Upstream commit d7808b37da0a619cf1fa541c2384e783fecc2480 ] virtinput_remove() unregisters the input device before resetting the virtio device. virtinput_recv_events() drops vi->lock around input_event(), so clearing vi->ready does not stop a callback that passed the entry check. It can still use vi->idev, requeue buffers and kick the queue. Reset first, as virtinput_freeze() already does. With the preceding core change, reset waits for callbacks before input_unregister_device() can free vi->idev. Recheck vi->ready after taking the lock again: keep draining completed events so an input packet is not truncated, but stop requeueing buffers and kicking the queue. With evdev attached, input_unregister_handle() currently waits for an RCU grace period, which also waits out IRQ callbacks. This masks the lifetime bug on PCI and MMIO, but does not protect sleepable callbacks on other transports. Fixes: 271c865161c5 ("Add virtio-input driver.") Assisted-by: LLM Signed-off-by: Karl Mehltretter Signed-off-by: Michael S. Tsirkin Message-ID: <20260905152059.89560-3-kmehltretter@gmail.com> Signed-off-by: Sasha Levin --- drivers/virtio/virtio_input.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/virtio/virtio_input.c b/drivers/virtio/virtio_input.c index 1a87be4c88cf5..e3bd0b9616f94 100644 --- a/drivers/virtio/virtio_input.c +++ b/drivers/virtio/virtio_input.c @@ -49,9 +49,12 @@ static void virtinput_recv_events(struct virtqueue *vq) le16_to_cpu(event->code), le32_to_cpu(event->value)); spin_lock_irqsave(&vi->lock, flags); + if (!vi->ready) + continue; virtinput_queue_evtbuf(vi, event); } - virtqueue_kick(vq); + if (vi->ready) + virtqueue_kick(vq); } spin_unlock_irqrestore(&vi->lock, flags); } @@ -351,8 +354,9 @@ static void virtinput_remove(struct virtio_device *vdev) vi->ready = false; spin_unlock_irqrestore(&vi->lock, flags); - input_unregister_device(vi->idev); + /* Callbacks use vi->idev. */ virtio_reset_device(vdev); + input_unregister_device(vi->idev); while ((buf = virtqueue_detach_unused_buf(vi->sts)) != NULL) kfree(buf); vdev->config->del_vqs(vdev); -- 2.53.0