> The vring size was read after virtio_fs_find_instance() had dropped
> virtio_fs_mutex, so a concurrent virtio_fs_remove() could free the
> virtqueue first. The reference from the lookup keeps the virtio_fs
> alive, but not its virtqueues.
>
> Hold the mutex across the lookup and the read.
>
> This issue was found by an in-house static analysis tool.
>
> Fixes: a7f0d7aab0b4 ("virtiofs: split requests that exceed virtqueue size")
> Cc: [email protected]
> Assisted-by: Codex:gpt-5.6
> Co-developed-by: Song Li <[email protected]>
> Signed-off-by: Song Li <[email protected]>
> Signed-off-by: Fan Wu <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
