virtio_pci: fix array index mismatch in vp_del_vqs

In vp_find_vqs_msix() and vp_find_vqs_intx(), the PCI device's virtqueue
info array vp_dev->vqs is incorrectly populated using the virtqueue
configuration array index i (from vqs_info).

However, during teardown, vp_del_vqs() (as well as vp_set_vq_affinity()
and vp_get_vq_affinity()) look up the info structure using vq->index,
which corresponds to queue_idx—a variable incremented only when a queue
is successfully instantiated (when vqi->name is not NULL).

When a virtio device (such as virtio-balloon) conditionally skips a
queue (e.g., free_page_vq is skipped when VIRTIO_BALLOON_F_FREE_PAGE_HINT
is off), i and queue_idx diverge. The reporting queue gets an index
i=4, but a queue_idx=3. vp_find_vqs_* erroneously populates
vp_dev->vqs[4]. During teardown, vp_del_vqs() checks
vp_dev->vqs[vq->index] (index 3), hitting an uninstantiated NULL slot.
It then cascades into an unchecked list_del() and triggers a kernel panic.

Fix this by ensuring vp_dev->vqs is always populated using the
queue's instantiated index (queue_idx), preventing offsetting.

Fixes: fd27ef6b44be ("virtio_pci: add admin vq wrapper and some helpers")
BUG=b/477623032
TEST=tested rmmod virtio_balloon with FS kernel on an E4 VM
RELEASE_NOTE=Fixed a kernel panic in virtio_pci teardown when virtually queues are conditionally skipped.

cos-patch: bug
Change-Id: I0d5ea76630af7a6778350294477112009cd64189
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/142006
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Miri Amarilio <mirilio@google.com>
1 file changed