virtio_reset_device() documents that vq callbacks are not in progress once it returns. virtio-pci delivers that by ending vp_reset() with vp_synchronize_vectors(), virtio-mmio does not, and a driver that frees state its callback uses then hits a use after free.
Patch 1 brings virtio-mmio in line with virtio-pci. Patch 2 makes virtio_input reset before unregistering its input device and stop its callback once teardown has begun. Together these patches fix the use after free on virtio-pci and virtio-mmio. Classic virtio-ccw and other transports still do not provide the documented guarantee. The use-after-free was reproduced under KASAN with the race window artificially widened. Callback synchronization was tested in an arm64 QEMU guest with a virtio-input device over virtio-mmio and four vCPUs. The event callback used a busy delay, not a sleep, and an in-progress counter tracked overlap with unbind. The driver was unbound and rebound 120 times under continuous input. With patch 2 alone, virtio_reset_device() returned before the callback finished in all 109 races, each in under 1 ms. With both patches, vm_reset() waited for the callback in all 111 races, taking 24 to 86 ms. Karl Mehltretter (2): virtio-mmio: synchronize callbacks during device reset virtio_input: stop callbacks before unregistering input device drivers/virtio/virtio_input.c | 8 ++++++-- drivers/virtio/virtio_mmio.c | 6 ++++++ 2 files changed, 12 insertions(+), 2 deletions(-) base-commit: 3eb40771c00a8488fa6ed2cc1fe203477908bf38 -- 2.53.0
