> From: Jerome Mohm <[email protected]> > > virtio_vsock_vqs_del() frees the virtqueues via del_vqs() but never > clears vsock->vqs[]. If a later virtio_vsock_restore() fails to > reallocate them (its error path is a bare "goto out" that only unlocks > and returns), the driver is left bound with a dangling vqs[]. The next > virtio_vsock_vqs_del() - on a second freeze or on remove/unbind - then > passes a freed vring_virtqueue to virtqueue_detach_unused_buf(), a slab > use-after-free. KASAN on a guest with a virtio-vsock device, after a > restore made to fail by fault injection: > > BUG: KASAN: slab-use-after-free in virtqueue_detach_unused_buf > Read of size 4 at addr ... by task repro > virtqueue_detach_unused_buf > virtio_vsock_vqs_del (net/vmw_vsock/virtio_transport.c:785) > [ ... ] > > Fixes: bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") > Cc: [email protected] > Assisted-by: LLM > Signed-off-by: Jerome Mohm <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
