Hi Thorsten, On Fri, 16 Oct 2026 at 16:16, Thorsten Blum <[email protected]> wrote: > > remove_common() frees the driver data during freeze, but does not clear > vdev->priv, which points to freed memory. If probe_common() then fails > during restore, a later remove or freeze can dereference the dangling > pointer. > > Clear vdev->priv on the probe_common() error cleanup path and before > freeing the driver data in remove_common(). Also reset the device and > return early from remove_common() if vdev->priv is already NULL for a > safe teardown after a failed restore. > > Fixes: 08e53fbdb85c ("virtio-rng: support multiple virtio-rng devices") > Cc: [email protected] > Signed-off-by: Thorsten Blum <[email protected]> > --- > drivers/char/hw_random/virtio-rng.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/char/hw_random/virtio-rng.c > b/drivers/char/hw_random/virtio-rng.c > index 5e83ffa105e4..a9ff520975a7 100644 > --- a/drivers/char/hw_random/virtio-rng.c > +++ b/drivers/char/hw_random/virtio-rng.c > @@ -190,6 +190,7 @@ static int probe_common(struct virtio_device *vdev) > err_find: > ida_free(&rng_index_ida, index); > err_ida: > + vdev->priv = NULL; > kfree(vi); > return err; > } > @@ -198,6 +199,11 @@ static void remove_common(struct virtio_device *vdev) > { > struct virtrng_info *vi = vdev->priv; > > + if (!vi) { > + virtio_reset_device(vdev); > + return; > + } > +
The virtio_reset_device() is always called before setting vdev->priv to NULL. So the virtio device is already quiesced, no need to do early return. Isn't it? > vi->hwrng_removed = true; > vi->data_avail = 0; > vi->data_idx = 0; > @@ -207,6 +213,7 @@ static void remove_common(struct virtio_device *vdev) > virtio_reset_device(vdev); > vdev->config->del_vqs(vdev); > ida_free(&rng_index_ida, vi->index); > + vdev->priv = NULL; > kfree(vi); > } > > The rest of the hunks are fine. Thanks, PrasannaKumar
