From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 93244396D19 for ; Tue, 4 Aug 2026 20:57:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785877052; cv=none; b=l7Xil85zdQ3YtwB+sxiTuiNvUlTQQoPF8mhNR1MuXoIydpmC/v5sNqDNjsxaWOCqViH43o7BNbJetUzA1f/MiMovcMeZ/zyXyfJ+BOernlqyLLG0aSh4Fk1pz0UbSbZ27hUkrOOUfiW2hs3/7k1OAlk0VnUxAoDcWVQLVyHed9I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785877052; c=relaxed/simple; bh=zD5QzuEXj/aW/lyMHglMqD82NgpBFpKJeLCBCUPLunU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=czoWtr3fEHwSUIJQ4/Wgad9buimThIq0gVeN41o9vaeYypu10AXnntb+fRAxWHkVe3RM6wbvUBKaNC57sT2qyJ3oiPzzPDnnJCZmauL8tJlm/dAXczXx+8as9CdJB3M+jTAKiPpuL57f39wR3z1bQsppY36CehL/kgQsOhTe8sk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=bp3eZG4o; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=CEBjlvd3; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="bp3eZG4o"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="CEBjlvd3" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1785877050; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=mOchbGmdt6N2onSSUp9osLcjLtTlXjiremk9zMAq/2Q=; b=bp3eZG4obKPXHUFoCyzRkX+G3ruktiiwRTg409ZelU3BW2jbemBmu6fs8Obwr3t4dxVNHE X8JUGG94VIJvrAo+Uy3wtit6js/45nZ8vGdd3+4LWtdMLo69903VmsXgAI8bZ7Wh/eP64h ruVd1CGZ6NImZiXIu872jY+9mSTVuD0= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-118-U2-HnMUUOj-dXllppEGtFw-1; Tue, 04 Aug 2026 16:57:29 -0400 X-MC-Unique: U2-HnMUUOj-dXllppEGtFw-1 X-Mimecast-MFC-AGG-ID: U2-HnMUUOj-dXllppEGtFw_1785877048 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-495569acf8dso1379815e9.1 for ; Tue, 04 Aug 2026 13:57:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1785877048; x=1786481848; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=mOchbGmdt6N2onSSUp9osLcjLtTlXjiremk9zMAq/2Q=; b=CEBjlvd3rPWpF2lCy6GDMngYWMf9g57vKTXi098/rWk4pYm+nbMzh89iDaqYpHLQfp HOk5VQ8T8nNo4RAo2+UWqROi1FooJmT7e523enPWjekGF98KaOowUb104tlOVj+KACK/ RoOd/guWqZBXUHLFHsvGOOlROxr1gC32b/IeXI3qEs87XrDeDsQfWdI9+m4AzeR+euqb /nGYDmV/EySCvg7KYyiL6WJ1qqjlK9z2gliLpqBvVb7mUPWdWNvYQCUw3ihU0yLUQC4j 0vtOZS9mx/A7RNHD+PyD06BfzNQ/4mx4VbmDZBgRNhFmNuMFvnxqMf4iYNGyd5ETfm5f EESA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785877048; x=1786481848; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=mOchbGmdt6N2onSSUp9osLcjLtTlXjiremk9zMAq/2Q=; b=CZGBgHTRSt5CASFdlIcTUqnqww2Fe64/VDUQzDb7zFIG0b+pYlk+4GK8apBqZJp4HL 125xVANLOR6IVW68dtRfufKA5dP2wNHScqJBIlmdooxX+ThQ73vy0PjA164ArurGT7oi d/9Z86dA12Fzg08gJQN54xsXClLWrPs54pBgBGcSIlBdDauYcEZDgjRlrq5pdR7sZ6U5 SdX+iINg+FAmt/Lx/6PnJkcjyWMECAQPwkM3OhrbpB+a8YquZFRIwo2wYC1Nwa0vTLrB jWzlccvg8As+PzJFLItuYKc/a7iyXxvDTJ5KskzI3e6wf88CyPjpAmOuZfMUfbUl7K7/ ZcGQ== X-Forwarded-Encrypted: i=1; AHgh+RrRhzEjLZVLup/bhr0sdskjXavjY4gQEgIU0xGpSX6z7uGLketDStL39csfg56BimFFvS7JTsMH6ta7Qk0=@vger.kernel.org X-Gm-Message-State: AOJu0Yx7b0ICrdUrMSC7Wqo7hdn/6K2i5aNSmdph4VkzUmr+p9jUVT3e VfCAKb67SoS9t3QJmf6Q29r+Tbu3+EHd6lFSVghVj7Mv7TobE+UW5S5JQuyrV8EQWG5mwTm0MaU RJGi9UJctUiW3S7BvSXRCd+5cmAWWgyNkl/rp+c3ZgfhlVrecEd8h7KXxpy4ymu+TQw== X-Gm-Gg: AR+sD13couv/EUDUozRWSsEq4MUodWagPTe5rI0RH+b5T2nVs7rk8oxP1npzmWMbJFd q74F2IfkHuPP5yvupb+bZt6eIquXpCi5/4NU9b1xIxFLHb91rCNCglfqg0+MjOp5b/nhXXM5OZm MnloXUgPoM/qoUbCoI5YyxgMX0tVz68TxFaedL5owS2Ml9eleVW54xU2vOPSXJw/XQJyV/Mzmmi DDRDiIoAr8zStdXp4HXHcdePN0MYgycN5/62wMKITx66xz80MheppKrHXjLVht+5zsCDBiwH3w8 xhmXlrYv3nRHtqei63+fLLAqYDuQup1rkAbHl6H7IYRvZ5d+Sy3CNe9E5LWIthIXjIMEJOQN7wF JY/33eAPwSdg0k6LzKUiumQ== X-Received: by 2002:a05:600c:8b51:b0:495:6b55:f938 with SMTP id 5b1f17b1804b1-4994e7ba99emr14318625e9.10.1785877047722; Tue, 04 Aug 2026 13:57:27 -0700 (PDT) X-Received: by 2002:a05:600c:8b51:b0:495:6b55:f938 with SMTP id 5b1f17b1804b1-4994e7ba99emr14318355e9.10.1785877047300; Tue, 04 Aug 2026 13:57:27 -0700 (PDT) Received: from redhat.com (IGLD-80-230-28-14.inter.net.il. [80.230.28.14]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49949fcb0c5sm107278235e9.4.2026.08.04.13.57.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Aug 2026 13:57:26 -0700 (PDT) Date: Tue, 4 Aug 2026 16:57:24 -0400 From: "Michael S. Tsirkin" To: Roi L Cc: Jason Wang , Xuan Zhuo , Eugenio =?iso-8859-1?Q?P=E9rez?= , virtualization@lists.linux.dev, linux-kernel@vger.kernel.org Subject: Re: [PATCH] virtio: virtio_ring: prevent potential null dereference on per-desc state Message-ID: <20260804165355-mutt-send-email-mst@kernel.org> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Tue, Aug 04, 2026 at 10:21:00PM +0300, Roi L wrote: > When accessing the per-descriptor state structure, we could overflow > desc_state[] because id can be accessed by the host and the guest > at the same time, as described by the packed implementation. it is validated: id = vring_read_packed_desc_id(vq, last_used); *len = vring_read_packed_desc_len(vq, last_used); if (unlikely(id >= num)) { BAD_RING(vq, "id %u out of range\n", id); return NULL; } > 'commit 32fe1de5c124 ("virtio_ring: Add READ_ONCE annotations for device-writable fields")' > > The commit mentions these are legitimate races, so I assume id might > get corrupted? "id" is actually just ""last_used"" in some contexts, > and at the path where last_used gets manipulated, KCSAN reports these races. > > I'm not sure if this is the right approach though, maybe we should handle it > differently other than just return? > > Signed-off-by: Roi L I don't understand what all this means. > --- > drivers/virtio/virtio_ring.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c > index b438dc2ce1b8..1d99b75f3bd7 100644 > --- a/drivers/virtio/virtio_ring.c > +++ b/drivers/virtio/virtio_ring.c > @@ -2025,6 +2025,8 @@ static void detach_buf_packed_in_order(struct vring_virtqueue *vq, > unsigned int i, curr; > > state = &vq->packed.desc_state[id]; > + if (unlikely(!state)) > + return; I don't see how it can be null even if id is out of range. > /* Clear data ptr. */ > state->data = NULL; > -- > 2.55.0