From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA9FF499F06 for ; Sat, 5 Sep 2026 15:21:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788621685; cv=none; b=PQ40qSnqhfzrmjBUbM6/Ki14o/rJ+wwO8HD8X4c2ltj+KEf/Ck20k8dgYTTH3SvuqZIBA3As1kGwTOKPNZKcPWCqVF2qOVHB9fLOpHmZSDrKQJhEbmedvOG8Q2zvC9y5z/at2lMQh3pGhDK72m9mv1jA8QeapzHba2znJo4/wa8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788621685; c=relaxed/simple; bh=eXG5r4mV6mtliuq56rwsHZv1ZiQbQWPta1t7fNcCzjM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=IzkkrVSuuGeiIk7QuaOBvsWdz5BS8kg0XlMADF0KAfJfZ6FEM7oc8tA07nP6584qqBNOD7FO6onF5y/61e5ej4Rpu/RI157IUd2iFt5LDsn9K57AmuT/qhystl5R82uVmSVA41QYOuYeqbw31eRnygUpwAd7/8xzZKoFggZAVEE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KKwDBaR+; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KKwDBaR+" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-499ae1c6471so18287225e9.3 for ; Sat, 05 Sep 2026 08:21:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788621679; x=1789226479; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Z2bLrkBK78EZ1kRlLHpZelHwP/1fERAUtU0NobzNbNE=; b=KKwDBaR+xVoJNuPew2OPxzm00SvEId9Hgpcslag6yAa1f+7i34VUFHTw5Z5mpCZYF2 00KfOp+vgRP5EYe/z6D4Myq+2L2nZAWMygqyMpDtcMMDUaqZ/rjDsQg2xTyRV7OwzplS EL140uDju05eBMwgpSzR5x4sqtSDz/kxs282bJX1sUWzdt/Z1t0oHjy3AHOsDZiF+GjS QzQe4t0iW/YjAwBQm3zoEDNIEaO9B8LFs3uSLVKq9aQtZ1zr0WkYNz5jYdONYF+BkkAZ SuxVrZZSE9yvdy4zeudQ+xYJxtSlhu8pqC3bjoh16ZiZ1YNSlYswHhHQkydbdi8NmiiC lGdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788621679; x=1789226479; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Z2bLrkBK78EZ1kRlLHpZelHwP/1fERAUtU0NobzNbNE=; b=SSb3PiT7TsV2pqPw9VsVxcyEktgRsOF7wniJn2FBuBM3tWpphMGDi0TA8YbPHpTiLz nqJTbWuonXtTRewwlKfXbtK0rQBhQ0NtWgnzhFGEuxHrna+nLtQnrt9Nj8hAz5BlF+XO tPJIIVBwOzM+cvj3KpWL2k1Efq5KOd/PqmUqxGVl/3khsIPcuhzC06xhwEdtRROqMJti ngA7cVjS8BhDL1AbNJ97yeUlCQLNN+r8Fl6VwX19lUC9rxEUwttaR71cPTgC9m001gPI JrezU8kw7HX6PFXXhVcmwqX/CPCw6OC1IwtwLG2uNYth14A7Eo0clutROOOcT/YqWxWW HJxw== X-Forwarded-Encrypted: i=1; AKwUvBzVxk/LQ1v2ISSv4bTqiCN2LasqnfrXlLES/bCxSNvr0v4IQy12MPyLjJyun7SOVAu8T7qwnYHTCrCbKqU=@vger.kernel.org X-Gm-Message-State: AFuF++lWSv6x0RZyDhaJWL79seJjtQpyOw0xl9EMgfi4WaJoszB2zjq/ H/7F9xnXoo1JDWi65m0DadmSApKpXPHMEMINn401yyeiVobh58yKy9zX X-Gm-Gg: AYBFou2Tlhu8D2u+bcTvvNTxHtMjRBZLP2AgqWKnZ4wVMP1CVZGjxHpR9ah4vYrSOHR SvU/fTQaSTzX4CvM31ZwbY9NaaGbLaz+d0GeuMyhSqNVcwSUbwzNrZJ1hRn1Go4TmBl/vrIo1lt 7dknmVKpKngWtfNn+5+AkSQf3SAdmtMSCy9DJYVYqGKXPgRsd4XzPCWkIeZC8qtZn9+DnCBqRA5 IoJxe/4f0o3VbXLOCQsAWj0U9uWvIWfnukbwdW/3onTerMBhXk1WgGg+jlgUQhyXAGF+DKU581V VrmdziIdA86f476KzhgYCdZcEVHmra0Fp5P68uSOyUMoW/w0q0sV/D8hkilxYYZnZ0vSEfPVgQl rIRjDvVNEPxjCKXGRFeFTM7orcZbNWH9N2gtb9zpvuMCdmBy4RdbF22zdGz+hF3BIqdbL/MFv+s oe626D6Hv5BpeQg5OhQAg1DqBhzJi1e8dJgtzkRyPO7RgHJzjduG9MQGmZaomnCuK0uGrK4qOcg jBSH0V2dVAXhfu9zOzXzueqd32kuwZcHXXXLrLuMqphrMdd0RaSy7t7HH62L+5vIpr7DujxGJOC I6lgUb9T2RydBNLUuXI7muAgUd+gpeMKkBB7T6jKLGWy23uAgpSvJ8EFR2If2PkgH0o= X-Received: by 2002:a05:600c:64c8:b0:495:4d5c:903e with SMTP id 5b1f17b1804b1-49cf81f692bmr245105885e9.7.1788621678914; Sat, 05 Sep 2026 08:21:18 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-a4eb-3001-c06d-af27-9fa2-ea53.310.pool.telefonica.de. [2a02:3100:a4eb:3001:c06d:af27:9fa2:ea53]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49cf75ce49esm267779515e9.1.2026.09.05.08.21.17 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 05 Sep 2026 08:21:18 -0700 (PDT) From: Karl Mehltretter To: "Michael S . Tsirkin" , Jason Wang , Gerd Hoffmann Cc: Karl Mehltretter , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Dmitry Torokhov , Rusty Russell , Pawel Moll , Cornelia Huck , Halil Pasic , Eric Farman , Richard Weinberger , Anton Ivanov , Johannes Berg , Hans de Goede , =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , Vadim Pasternak , Bjorn Andersson , Mathieu Poirier , virtualization@lists.linux.dev, linux-input@vger.kernel.org, linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-um@lists.infradead.org, platform-driver-x86@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/3] virtio_input: stop callbacks before unregistering input device Date: Sat, 5 Sep 2026 17:20:58 +0200 Message-Id: <20260905152059.89560-3-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260905152059.89560-1-kmehltretter@gmail.com> References: <20260905152059.89560-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit virtinput_remove() unregisters the input device before resetting the virtio device. virtinput_recv_events() drops vi->lock around input_event(), so clearing vi->ready does not stop a callback that passed the entry check. It can still use vi->idev, requeue buffers and kick the queue. Reset first, as virtinput_freeze() already does. With the preceding core change, reset waits for callbacks before input_unregister_device() can free vi->idev. Recheck vi->ready after taking the lock again: keep draining completed events so an input packet is not truncated, but stop requeueing buffers and kicking the queue. With evdev attached, input_unregister_handle() currently waits for an RCU grace period, which also waits out IRQ callbacks. This masks the lifetime bug on PCI and MMIO, but does not protect sleepable callbacks on other transports. Fixes: 271c865161c5 ("Add virtio-input driver.") Assisted-by: LLM Signed-off-by: Karl Mehltretter --- drivers/virtio/virtio_input.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/virtio/virtio_input.c b/drivers/virtio/virtio_input.c index deec24e8e682..7b654af0a42c 100644 --- a/drivers/virtio/virtio_input.c +++ b/drivers/virtio/virtio_input.c @@ -49,9 +49,12 @@ static void virtinput_recv_events(struct virtqueue *vq) le16_to_cpu(event->code), le32_to_cpu(event->value)); spin_lock_irqsave(&vi->lock, flags); + if (!vi->ready) + continue; virtinput_queue_evtbuf(vi, event); } - virtqueue_kick(vq); + if (vi->ready) + virtqueue_kick(vq); } spin_unlock_irqrestore(&vi->lock, flags); } @@ -350,8 +353,9 @@ static void virtinput_remove(struct virtio_device *vdev) vi->ready = false; spin_unlock_irqrestore(&vi->lock, flags); - input_unregister_device(vi->idev); + /* Callbacks use vi->idev. */ virtio_reset_device(vdev); + input_unregister_device(vi->idev); while ((buf = virtqueue_detach_unused_buf(vi->sts)) != NULL) kfree(buf); vdev->config->del_vqs(vdev); -- 2.39.5 (Apple Git-154)