> This reverts commit a663b3c47ab10f66130818cf94eb59c971541c3f.
>
> When a transfer is interrupted by a signal, virtio_i2c_complete_reqs()
> stops waiting for the remaining requests and virtio_i2c_xfer() frees the
> reqs array while the virtqueue descriptors are still in flight on the
> device. The backend can then write into freed memory, and
> virtio_i2c_msg_done() calls complete() on already-freed requests.
>
> Commit 84e1d0bf1d71 ("i2c: virtio: disable timeout handling") removed the
> exact same failure mode caused by timeouts, concluding there was no simple
> fix because the buffers must be held until the device returns them. A hang
> due to an unresponsive backend is preferable to guest memory corruption.
> Restore the unconditional wait until request lifetime can be decoupled
> safely.
>
> Fixes: a663b3c47ab1 ("i2c: virtio: Avoid hang by using interruptible
> completion wait")
> Cc: [email protected]
> Signed-off-by: Yuho Choi <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
