> The input virtqueue callback calls hvc_poll() on port->cons.hvc
> without any synchronization against HVC adapter removal. A port
> removed via a VIRTIO_CONSOLE_PORT_REMOVE control message runs
> unplug_port() -> hvc_remove(), which drops the adapter's last
> tty_port reference and frees it, while the callback may still be
> about to dereference the freed adapter:
>
> BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave
> BUG: KASAN: slab-use-after-free in __hvc_poll
>
> Both sides hold only the port kref; nothing protects
> struct hvc_struct between the callback's pointer read and its use.
>
> Do not touch the adapter from hard IRQ context at all. Only wake
> the HVC worker with hvc_kick(): khvcd polls registered adapters
> [ ... ]
> This issue was investigated and the fix was developed with AI
> assistance (ZCode/GLM-4).
>
> Fixes: 203baab8ba319 ("virtio: console: Introduce function to hand off data
> from host to readers")
> Signed-off-by: Yaohan Li <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
