Re: [PATCH net v4] vsock/virtio: clear vqs[] to avoid a UAF on a failed PM restore

[Stefano Garzarella]

On Mon, Nov 09, 2026 at 08:39:24PM +0100, Jerome Mohm via B4 Relay wrote:
> From: Jerome Mohm <jrmmhm.kernel@xxxxxxxxx>
>
> virtio_vsock_vqs_del() frees the virtqueues but leaves vsock->vqs[]
> pointing at them. If virtio_vsock_restore() then fails, the driver
> stays bound with a dangling vqs[], and the next freeze or unbind
> passes a freed virtqueue to virtqueue_detach_unused_buf():
>
>  BUG: KASAN: slab-use-after-free in virtqueue_detach_unused_buf
>   virtio_vsock_vqs_del (net/vmw_vsock/virtio_transport.c:785)
>   virtio_vsock_remove
>  Freed by task ...:
>   vp_del_vqs
>   virtio_vsock_freeze
>
> Clear vqs[] after del_vqs() and when virtio_find_vqs() fails. Return
> early from virtio_vsock_vqs_del() when vqs[] is empty: the detach
> loops would pass NULL to virtqueue_detach_unused_buf(), and a second
> del_vqs() would free virtio-mmio's IRQ again, which only WARNs in
> free_irq() ("Trying to free already-free IRQ").
>
> Found with the help of Anthropic's Claude and reproduced on virtio-pci
> and virtio-mmio by failing the restore with failslab, without other
> kernel changes; the virtio-mmio WARN was found by the netdev Sashiko
> review and reproduced with v1 of this patch. With this patch neither
> report appears on virtio-pci or virtio-mmio guests, and the vsock
> vmtest.sh single-VM tests pass. A find_vqs() failure after some
> virtqueues were set up was not exercised.
>
> Fixes: bd50c5dc182b ("vsock/virtio: add support for device suspend/resume")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jerome Mohm <jrmmhm.kernel@xxxxxxxxx>
> ---
> Changes in v4:
> - Say why the early return is needed: the detach loops would pass NULL
>  to virtqueue_detach_unused_buf() (answering Stefano).
> - Say in the message and the comment that freeing virtio-mmio's IRQ
>  again only WARNs (Stefano).
> - Move the send queue purge before virtio_reset_device() (Stefano).
> - Message: the use-after-free also reproduces on virtio-mmio.
> - Rebase onto current net; rebuilt and retested on virtio-pci and
>  virtio-mmio, and the vmtest.sh single-VM tests rerun on this version.
>  The moved purge ran with an empty send queue only; the ns_* tests of
>  vmtest.sh were not run (they need root on the host). The reproducers
>  are available on request.
> - Link to v3: https://patch.msgid.link/20261104-vsock-restore-uaf-send-v3-1-d60d06488b57@xxxxxxxxx
> ---
> net/vmw_vsock/virtio_transport.c | 16 +++++++++++++---
> 1 file changed, 13 insertions(+), 3 deletions(-)

Reviewed-by: Stefano Garzarella <sgarzare@xxxxxxxxxx>

Thanks,
Stefano