Hi all,
This patchset addresses several critical race conditions and memory
lifecycle bugs in the virtio_console driver, primarily surrounding
the TX path(`__send_to_port`, `put_chars`), device hot-unplug, and
PM freeze/restore.
The initial motivation for this series was to fix a race where
`hvc_console` writes (which can remain active during suspend
if `no_console_suspend` is enabled) could enqueue buffers while
`virtcons_freeze` was tearing down virtqueues, leading to a `BUG_ON` in
`virtqueue_detach_unused_buf_split()`.
During the investigation and testing of the freeze race, several related
vulnerabilities were uncovered in how TX paths handled buffer ownership and
stale `portdev` pointers during concurrent hot-unplugs. Because these fixes
structurally overlap in `__send_to_port()` and `put_chars()`, they are
submitted together as a single patchset to avoid merge conflicts.
Patch Summary
=============
1. virtio_console: refactor __send_to_port() buffer ownership
Refactors buffer ownership in `__send_to_port()`. Previously,
`put_chars()` would allocate a raw buffer, pass it down, and `kfree()`
it immediately upon return. If `virtqueue_get_buf()` returned an older
completed buffer from a previous non-blocking write, the newly queued
buffer could be freed while the host was still DMA-ing from it.
By transferring ownership of a `struct port_buffer` to
`__send_to_port()`, we guarantee only the exact buffer returned by
the host is freed.
2. virtio_console: fix hot-unplug races in TX paths
Hardens the TX paths against concurrent hot-unplugs. It adds
`READ_ONCE(port->portdev)` checks, bails out cleanly (returning `count`
to prevent `hvc` infinite retries), and synchronizes `portdev = NULL`
in `unplug_port()` using the `outvq_lock`.
3. virtio_console: fix control queue race during restore
Fixes a race during `virtcons_restore()` where filling the control
receive queue (c_ivq) immediately after `DRIVER_OK` could trigger the
control workqueue before the driver finished restoring port states,
leading to list corruption.
4. virtio_console: fix race between hvc put_chars and virtqueue teardown
Addresses the original PM freeze race by introducing a `pm_freezing`
state. TX paths now safely drop output while freezing.
A synchronization loop in `virtcons_freeze()` ensures all active TX
threads have drained before `virtio_reset_device()` is called.
Testing
=======
Runtime-tested on arm64 systems with `no_console_suspend` enabled
during S4 cycles.
Changes
=======
v3:
Split the original monolithic patch into a 4-part patchset for better
logical grouping and bisectability.
Sungho Bae (4):
virtio_console: refactor __send_to_port() buffer ownership
virtio_console: fix hot-unplug races in TX paths
virtio_console: fix control queue race during restore
virtio_console: fix race between hvc put_chars and virtqueue teardown
on freeze
drivers/char/virtio_console.c | 177 ++++++++++++++++++++++++++--------
1 file changed, 137 insertions(+), 40 deletions(-)
--
2.34.1
