Post by @ammarfaizi2@social.gnuweeb.org

@ammarfaizi2@social.gnuweeb.org

2026-03-14 16:17 UTC

@yuka@s.umeyashiki.org @ammarfaizi2@hiradai.space After reviewing the possibility that the `info` pointer could be NULL, I realized the previous fix was wrong. In here: https://elixir.bootlin.com/linux/v6.19.7/source/drivers/virtio/virtio_pci_common.c#L279 The `info` pointer is dereferenced. That means the `info` pointer is expected not to be NULL. We were just lucky that the virtio balloon device doesn't have `->per_vq_vectors`. The previous fix just masked the bug. I didn't actually solve the problem.

Replies (1)

@ammarfaizi2@hiradai.space 2026-03-14 16:35

@yuka@s.umeyashiki.org @ammarfaizi2@social.gnuweeb.org Can you revert the previous patch, apply this patch, then try unbinding and rebinding the virtio balloon again? See whether the NULL ptr deref still exists. diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c index da97b6a988de..164f480b18a6 100644 --- a/drivers/virtio/virtio_pci_common.c +++ b/drivers/virtio/virtio_pci_common.c @@ -423,10 +423,11 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned int nvqs, vqs[i] = NULL; continue; } - vqs[i] = vp_find_one_vq_msix(vdev, queue_idx++, vqi->callback, + vqs[i] = vp_find_one_vq_msix(vdev, queue_idx, vqi->callback, vqi->name, vqi->ctx, false, &allocated_vectors, vector_policy, - &vp_dev->vqs[i]); + &vp_dev->vqs[queue_idx]); + queue_idx++; if (IS_ERR(vqs[i])) { err = PTR_ERR(vqs[i]); goto error_find; @@ -485,9 +486,10 @@ static int vp_find_vqs_intx(struct virtio_device *vdev, unsigned int nvqs, vqs[i] = NULL; continue; } - vqs[i] = vp_setup_vq(vdev, queue_idx++, vqi->callback, + vqs[i] = vp_setup_vq(vdev, queue_idx, vqi->callback, vqi->name, vqi->ctx, - VIRTIO_MSI_NO_VECTOR, &vp_dev->vqs[i]); + VIRTIO_MSI_NO_VECTOR, &vp_dev->vqs[queue_idx]); + queue_idx++; if (IS_ERR(vqs[i])) { err = PTR_ERR(vqs[i]); goto out_del_vqs;

Open ##3421603