> The read path hands port buffers to readers without any ownership
> protocol. Two threads sharing one file descriptor can both pick up
> port->inbuf, copy from it concurrently and requeue it twice, and an
> input virtqueue callback prefetching the next buffer can drop the
> remainder a reader is about to put back. During port unplug a
> reader can also call add_inbuf() on a virtqueue that is being torn
> down (KASAN: slab-use-after-free in virtqueue_get_buf_ctx), or
> requeue a buffer nobody will free anymore. The input virtqueue
> callback itself can run past find_port_by_vq() into port->portdev
> and the virtqueue after unplug_port() has cleared them.
>
> Track buffer ownership explicitly:
>
> - fill_readbuf() claims port->inbuf under inbuf_lock and owns it
> exclusively across the unlocked copy. port_read_snapshot() and
> [ ... ]
> DMA buffer path is covered by code inspection of the claim, deferred
> free and reclaim ordering, not by a runtime test.
>
> Fixes: 203baab8ba319 ("virtio: console: Introduce function to hand off data
> from host to readers")
> Signed-off-by: Yaohan Li <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
