Post by @ammarfaizi2@social.gnuweeb.org

@ammarfaizi2@social.gnuweeb.org

2026-03-13 06:32 UTC

@yuka@s.umeyashiki.org The calls look like this: ``` -> vp_del_vqs() -> vp_del_vq() -> list_del() -> __list_del_entry() -> __list_del_entry_valid() -> __list_del_entry_valid_or_report() <--- NULL ptr deref here ```

Replies (1)

@ammarfaizi2@hiradai.space 2026-03-13 07:22

@ammarfaizi2@social.gnuweeb.org @yuka@s.umeyashiki.org [ Moving to my Sharkey account as Mastodon doesn't support writing in markdown format. ] I have narrowed it down, using scripts/decode_stacktrace.sh, it results in the following disassembly: [ 264.567431] Code: [[snip]] cc cc cc cc 41 57 41 56 53 8b 1f 48 85 db 74 38 4c 8b 77 08 4d 85 f6 74 40 49 bf 00 01 00 ======== 21: cc int3 22: cc int3 23: cc int3 24: cc int3 25: 41 57 push %r15 27: 41 56 push %r14 29: 53 push %rbx 2a:*48 8b 1f mov (%rdi),%rbx node); where info is a pointer to struct virtio_pci_vq_info. https://elixir.bootlin.com/linux/v6.19.7/source/drivers/virtio/virtio_pci_common.c#L258 That means the info pointer in vp_del_vq() is NULL. %rdi is the first argument to __list_del_entry_valid_or_report(). There is a load to the next pointer of the struct list_head, this is where the NULL ptr dereference happens. https://elixir.bootlin.com/linux/v6.19.7/source/lib/list_debug.c#L49-L50

Open ##3421614