)]}'
{
  "commit": "350c271d1b528bc4fe572d2cadd2a16c3a758e41",
  "tree": "ace4d859f2845306a681a744a0bd470b886d502b",
  "parents": [
    "95e3317c03816d2a958f9aee05d52d08c50b7e2c"
  ],
  "author": {
    "name": "Link Lin",
    "email": "linkl@google.com",
    "time": "Mon Mar 30 12:33:53 2026 -0700"
  },
  "committer": {
    "name": "Kevin Berry",
    "email": "kpberry@google.com",
    "time": "Wed Apr 01 16:46:43 2026 -0700"
  },
  "message": "virtio_pci: fix array index mismatch in vp_del_vqs\n\nThe Issue: During the teardown of the virtio_balloon module (e.g., via rmmod virtio_balloon), a kernel NULL pointer dereference occurs. The crash cascades into an unchecked list_del() and triggers the following kernel panic:\n[12261.808190] Call trace:\n[12261.808471]  __list_del_entry_valid_or_report+0x18/0xe0\n[12261.809064]  vp_del_vqs+0x12c/0x270\n[12261.809462]  remove_common+0x80/0x98 [virtio_balloon]\n[12261.810034]  virtballoon_remove+0xfc/0x158 [virtio_balloon]\n[12261.810663]  virtio_dev_remove+0x68/0xf8\n[12261.811108]  device_release_driver_internal+0x17c/0x278\n[12261.811701]  driver_detach+0xd4/0x138\n[12261.812117]  bus_remove_driver+0x90/0xd0\n[12261.812562]  driver_unregister+0x40/0x70\n[12261.813006]  unregister_virtio_driver+0x20/0x38\n[12261.813518]  cleanup_module+0x20/0x7a8 [virtio_balloon]\n[12261.814109]  __arm64_sys_delete_module+0x278/0x3d0\n[12261.814654]  invoke_syscall+0x5c/0x120\n[12261.815086]  el0_svc_common+0x90/0xf8\n[12261.815506]  do_el0_svc+0x2c/0x48\n[12261.815883]  el0_svc+0x3c/0xa8\n[12261.816235]  el0t_64_sync_handler+0x8c/0x108\n[12261.816724]  el0t_64_sync+0x198/0x1a0\n[12261.817141] Code: d503233f a9bf7bfd 910003fd aa0003e1 (f9400003)\n[12261.817874] SMP: stopping secondary CPUs\n[12261.818614] Starting crashdump kernel...\n[12261.819053] Bye!\n\nThe Root Cause: In vp_find_vqs_msix() and vp_find_vqs_intx(), the PCI device\u0027s virtqueue info array vp_dev-\u003evqs is erroneously populated using the virtqueue configuration array index i. However, during teardown, vp_del_vqs() looks up the info structure using vq-\u003eindex, which corresponds to queue_idx (incremented only when a queue is instantiated).\nWhen a virtio device conditionally skips a queue, i and queue_idx diverge. The debug log proves what the issue is during instantiation and later removal:\n\n[    2.334426] DEBUG: Created intx virtqueue \u0027inflate\u0027 (queue_idx: 0, Config index i: 0, info ptr: ffff935fc1dbbee0)\n[    2.347020] DEBUG: Created intx virtqueue \u0027deflate\u0027 (queue_idx: 1, Config index i: 1, info ptr: ffff935fc1dbb7a0)\n[    2.361307] DEBUG: Created intx virtqueue \u0027stats\u0027 (queue_idx: 2, Config index i: 2, info ptr: ffff935fc1dbbdc0)\n[    2.372745] DEBUG: Created intx virtqueue \u0027reporting_vq\u0027 (queue_idx: 3, Config index i: 4, info ptr: ffff935fc1dbb860)\n[  435.481126] DEBUG: Removing virtqueue \u0027inflate\u0027 (index: 0, info ptr: ffff935fc1dbbee0)\n[  435.504159] DEBUG: Removing virtqueue \u0027deflate\u0027 (index: 1, info ptr: ffff935fc1dbb7a0)\n[  435.525601] DEBUG: Removing virtqueue \u0027stats\u0027 (index: 2, info ptr: ffff935fc1dbbdc0)\n[  435.546626] DEBUG: Removing virtqueue \u0027reporting_vq\u0027 (index: 3, info ptr: ffff935fc1dbb860)\n\nThe reporting queue gets an index i\u003d4, but a queue_idx\u003d3. During teardown, vp_del_vqs() checks vp_dev-\u003evqs[3], hitting an uninstantiated NULL slot.\n\nThe Fix: This change fixes the divergence of queue_idx and i by explicitly using \u0026vp_dev-\u003evqs[vq_idx] instead of the configuration index. This guarantees vp_dev-\u003evqs is always populated using the queue\u0027s successfully instantiated index, preventing offsetting and the resulting NULL pointer dereference.\n\nFixes: fd27ef6b44be (\"virtio_pci: add admin vq wrapper and some helpers\")\nBug: b/477623032\nTEST\u003dtested rmmod virtio_balloon with FS kernel on an E4 VM\nRELEASE_NOTE\u003dFixes a kernel panic in virtio_pci teardown when virtually queues are conditionally skipped.\n\nChange-Id: I0d5ea76630af7a6778350294477112009cd64189\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/141563\nReviewed-by: Chetan Sharma \u003cqoogle@google.com\u003e\nReviewed-by: Miri Amarilio \u003cmirilio@google.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "88074451dd6151f03cfa384ff0893852f302eda4",
      "old_mode": 33188,
      "old_path": "drivers/virtio/virtio_pci_common.c",
      "new_id": "52004113d8c387e0f75ff2bd812a7fc1581a5dbc",
      "new_mode": 33188,
      "new_path": "drivers/virtio/virtio_pci_common.c"
    }
  ]
}