On Tue, Aug 18, 2026 at 06:04:31AM +0200, Karl Mehltretter wrote: > virtio_reset_device() documents that vq callbacks are not in progress > once it returns. virtio-pci delivers that by ending vp_reset() with > vp_synchronize_vectors(), virtio-mmio does not, and a driver that frees > state its callback uses then hits a use after free. > > Patch 1 brings virtio-mmio in line with virtio-pci. > > Patch 2 makes virtio_input reset before unregistering its input device > and stop its callback once teardown has begun. > > Together these patches fix the use after free on virtio-pci
pci has synchronize on reset already > and > virtio-mmio. Classic virtio-ccw and other transports still > do not provide the documented guarantee. > > The use-after-free was reproduced under KASAN with the race window > artificially widened. > > Callback synchronization was tested in an arm64 QEMU guest with a > virtio-input device over virtio-mmio and four vCPUs. The event callback > used a busy delay, not a sleep, and an in-progress counter tracked > overlap with unbind. > > The driver was unbound and rebound 120 times under continuous input. > With patch 2 alone, virtio_reset_device() returned before the callback > finished in all 109 races, each in under 1 ms. With both patches, > vm_reset() waited for the callback in all 111 races, taking 24 to 86 ms. > > Karl Mehltretter (2): > virtio-mmio: synchronize callbacks during device reset > virtio_input: stop callbacks before unregistering input device > > drivers/virtio/virtio_input.c | 8 ++++++-- > drivers/virtio/virtio_mmio.c | 6 ++++++ > 2 files changed, 12 insertions(+), 2 deletions(-) > > > base-commit: 3eb40771c00a8488fa6ed2cc1fe203477908bf38 > -- > 2.53.0
