From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 992E9308F3C for ; Sat, 5 Sep 2026 15:21:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788621685; cv=none; b=c894g9DU4DunaTjxfM/dQoeu19FZzhP23FypW/kZZWBmNqwNrlyPrLaB2Wc8i54CAKCWfMVPIIimKtO1+0ScYboHgEyM4rgoQidzKtK4BRusA9HeG2urhdEM8glFFrkafSDknuDUCSRH1lhNrC0Gu8/OD2fUmjuARMANoJwG9+E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788621685; c=relaxed/simple; bh=eXG5r4mV6mtliuq56rwsHZv1ZiQbQWPta1t7fNcCzjM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=IzkkrVSuuGeiIk7QuaOBvsWdz5BS8kg0XlMADF0KAfJfZ6FEM7oc8tA07nP6584qqBNOD7FO6onF5y/61e5ej4Rpu/RI157IUd2iFt5LDsn9K57AmuT/qhystl5R82uVmSVA41QYOuYeqbw31eRnygUpwAd7/8xzZKoFggZAVEE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KKwDBaR+; arc=none smtp.client-ip=209.85.128.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KKwDBaR+" Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-499ae1c6471so18287235e9.3 for ; Sat, 05 Sep 2026 08:21:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788621679; x=1789226479; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Z2bLrkBK78EZ1kRlLHpZelHwP/1fERAUtU0NobzNbNE=; b=KKwDBaR+xVoJNuPew2OPxzm00SvEId9Hgpcslag6yAa1f+7i34VUFHTw5Z5mpCZYF2 00KfOp+vgRP5EYe/z6D4Myq+2L2nZAWMygqyMpDtcMMDUaqZ/rjDsQg2xTyRV7OwzplS EL140uDju05eBMwgpSzR5x4sqtSDz/kxs282bJX1sUWzdt/Z1t0oHjy3AHOsDZiF+GjS QzQe4t0iW/YjAwBQm3zoEDNIEaO9B8LFs3uSLVKq9aQtZ1zr0WkYNz5jYdONYF+BkkAZ SuxVrZZSE9yvdy4zeudQ+xYJxtSlhu8pqC3bjoh16ZiZ1YNSlYswHhHQkydbdi8NmiiC lGdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788621679; x=1789226479; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Z2bLrkBK78EZ1kRlLHpZelHwP/1fERAUtU0NobzNbNE=; b=gMya6wrTk/QJ0x7AS8s3a8NNrFOZxRUN9tOoStToVjhUYJvrYTXIuOVUBAmnpyNEzS ryfMzcM6TCeb8DFjFRCmQvgZDzQs8cOdiCJ1EWukmgqSyg4gdvgudyBv546tBopHTAsN /bbufaLmmwtpzJj3LTebzULeymYaubVmsuF7Y7xPw65iMKrv2bWWvvzVflNA90be2Dit OJp8aej4vvjzQ4fmvNcTFg1Gy3lQV2KL0jDEIDwbMcStZwHC3Iy6ayffUEEbyij671DW 27Ycr6lnaLQdoiwYRYX4D9hlBJtzeTvpyqmCkNhfZVqsXSzcGEGoK2kn7iAuvBWWYW/R f19w== X-Forwarded-Encrypted: i=1; AKwUvBxAU9Rbl1XK21MJ5/rKBmsFL55fdzISW9odFgsJmI8wiRonjUC0uR2H0bGoX4M9zPw8CwU=@vger.kernel.org X-Gm-Message-State: AFuF++nE2ik7vMv0RnCw2AxCz85a29Cqmy2XE/Tl+hTrThudLOfY1BLD 9xEg12Dhd13OS1xQg4oSJRC2T1VXCWstWt4fgOkZZ5Vedz8NCWv7Cjiq X-Gm-Gg: AYBFou0p+U4OcS7om5/JkbXATm2YTx017g96LFId3vySGZAxpYMS3ZxH2xlVgokLnRy p9W9lmM9qnn+dYuWT/Vr1mAkWsRAAhBxtQ3z4rTPumGf4kIoL80Hf/UYLJwXc9j+w1nO0PL7vdN jxJ7W9h1X2wsFkhCOy9icRQpQr10GJG/3kDnXw9a5/3iNGLA/AC8voEZ5yHzMEGxVA59NerY/o/ zurV3yliEYkYrGf5qECyCE8o2disL5BJwT88klFdmzFUnd/GQxYETpGMQQKKAWitS+zduBFXAov BWU0Kz61wVs5Ih9P+v00Hp2A0SnQcjy3Hm9npZQrVriv1KlgHSPJucS9RSABkmBJH7Qbu+kqUiT c7lfcqEy6pAEscIqERE6KJd9txwTYgqXZmFAeZyiJnwLLg1DPn4hNZZgCk1Dl+UZuOFAfsh6RKQ Cc7FIsvah+5/Dal+VJSqR8sP7Kc6CWnIx+C19+PTvomb21eklYC/ts7sz4p/cuCo9a9dW0N0DUH lbUuTAMB7DppHqs9+XgKD+ePtVFrO59MO9eth7LGMyGasGwOIR0aPQoy5mD0AxuTZvI89oqToDA u4gLqJGn+ITBrgNz8VYpUc5YumADclogqxr1xOAKiUuX8DMsUtzq5C4U77iFzgc4k+w= X-Received: by 2002:a05:600c:64c8:b0:495:4d5c:903e with SMTP id 5b1f17b1804b1-49cf81f692bmr245105885e9.7.1788621678914; Sat, 05 Sep 2026 08:21:18 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-a4eb-3001-c06d-af27-9fa2-ea53.310.pool.telefonica.de. [2a02:3100:a4eb:3001:c06d:af27:9fa2:ea53]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49cf75ce49esm267779515e9.1.2026.09.05.08.21.17 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 05 Sep 2026 08:21:18 -0700 (PDT) From: Karl Mehltretter To: "Michael S . Tsirkin" , Jason Wang , Gerd Hoffmann Cc: Karl Mehltretter , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Dmitry Torokhov , Rusty Russell , Pawel Moll , Cornelia Huck , Halil Pasic , Eric Farman , Richard Weinberger , Anton Ivanov , Johannes Berg , Hans de Goede , =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , Vadim Pasternak , Bjorn Andersson , Mathieu Poirier , virtualization@lists.linux.dev, linux-input@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-um@lists.infradead.org, platform-driver-x86@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/3] virtio_input: stop callbacks before unregistering input device Date: Sat, 5 Sep 2026 17:20:58 +0200 Message-Id: <20260905152059.89560-3-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260905152059.89560-1-kmehltretter@gmail.com> References: <20260905152059.89560-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: kvm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit virtinput_remove() unregisters the input device before resetting the virtio device. virtinput_recv_events() drops vi->lock around input_event(), so clearing vi->ready does not stop a callback that passed the entry check. It can still use vi->idev, requeue buffers and kick the queue. Reset first, as virtinput_freeze() already does. With the preceding core change, reset waits for callbacks before input_unregister_device() can free vi->idev. Recheck vi->ready after taking the lock again: keep draining completed events so an input packet is not truncated, but stop requeueing buffers and kicking the queue. With evdev attached, input_unregister_handle() currently waits for an RCU grace period, which also waits out IRQ callbacks. This masks the lifetime bug on PCI and MMIO, but does not protect sleepable callbacks on other transports. Fixes: 271c865161c5 ("Add virtio-input driver.") Assisted-by: LLM Signed-off-by: Karl Mehltretter --- drivers/virtio/virtio_input.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/virtio/virtio_input.c b/drivers/virtio/virtio_input.c index deec24e8e682..7b654af0a42c 100644 --- a/drivers/virtio/virtio_input.c +++ b/drivers/virtio/virtio_input.c @@ -49,9 +49,12 @@ static void virtinput_recv_events(struct virtqueue *vq) le16_to_cpu(event->code), le32_to_cpu(event->value)); spin_lock_irqsave(&vi->lock, flags); + if (!vi->ready) + continue; virtinput_queue_evtbuf(vi, event); } - virtqueue_kick(vq); + if (vi->ready) + virtqueue_kick(vq); } spin_unlock_irqrestore(&vi->lock, flags); } @@ -350,8 +353,9 @@ static void virtinput_remove(struct virtio_device *vdev) vi->ready = false; spin_unlock_irqrestore(&vi->lock, flags); - input_unregister_device(vi->idev); + /* Callbacks use vi->idev. */ virtio_reset_device(vdev); + input_unregister_device(vi->idev); while ((buf = virtqueue_detach_unused_buf(vi->sts)) != NULL) kfree(buf); vdev->config->del_vqs(vdev); -- 2.39.5 (Apple Git-154)