Re: [PATCH v2] virtio_console: defer HVC polling out of the virtqueue callback

[sashiko-bot@kernel.org]

> The input virtqueue callback calls hvc_poll() on port->cons.hvc
> without any synchronization against HVC adapter removal.  A port
> removed via a VIRTIO_CONSOLE_PORT_REMOVE control message runs
> unplug_port() -> hvc_remove(), which drops the adapter's last
> tty_port reference and frees it, while the callback may still be
> about to dereference the freed adapter:
> 
>     BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave
>     BUG: KASAN: slab-use-after-free in __hvc_poll
> 
> Both sides hold only the port kref; nothing protects
> struct hvc_struct between the callback's pointer read and its use.
> 
> Do not touch the adapter from hard IRQ context at all.  Only wake
> the HVC worker with hvc_kick(): khvcd polls registered adapters
> [ ... ]
> This issue was investigated and the fix was developed with AI
> assistance (ZCode/GLM-4).
> 
> Fixes: 203baab8ba319 ("virtio: console: Introduce function to hand off data from host to readers")
> Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105114450.971521-1-shunsheng1218@gmail.com?part=1