CVE-2025-37805

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sound/virtio: Fix cancel_sync warnings on uninitialized work_structs<br /> <br /> Betty reported hitting the following warning:<br /> <br /> [ 8.709131][ T221] WARNING: CPU: 2 PID: 221 at kernel/workqueue.c:4182<br /> ...<br /> [ 8.713282][ T221] Call trace:<br /> [ 8.713365][ T221] __flush_work+0x8d0/0x914<br /> [ 8.713468][ T221] __cancel_work_sync+0xac/0xfc<br /> [ 8.713570][ T221] cancel_work_sync+0x24/0x34<br /> [ 8.713667][ T221] virtsnd_remove+0xa8/0xf8 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]<br /> [ 8.713868][ T221] virtsnd_probe+0x48c/0x664 [virtio_snd ab15f34d0dd772f6d11327e08a81d46dc9c36276]<br /> [ 8.714035][ T221] virtio_dev_probe+0x28c/0x390<br /> [ 8.714139][ T221] really_probe+0x1bc/0x4c8<br /> ...<br /> <br /> It seems we&amp;#39;re hitting the error path in virtsnd_probe(), which<br /> triggers a virtsnd_remove() which iterates over the substreams<br /> calling cancel_work_sync() on the elapsed_period work_struct.<br /> <br /> Looking at the code, from earlier in:<br /> virtsnd_probe()-&gt;virtsnd_build_devs()-&gt;virtsnd_pcm_parse_cfg()<br /> <br /> We set snd-&gt;nsubstreams, allocate the snd-&gt;substreams, and if<br /> we then hit an error on the info allocation or something in<br /> virtsnd_ctl_query_info() fails, we will exit without having<br /> initialized the elapsed_period work_struct.<br /> <br /> When that error path unwinds we then call virtsnd_remove()<br /> which as long as the substreams array is allocated, will iterate<br /> through calling cancel_work_sync() on the uninitialized work<br /> struct hitting this warning.<br /> <br /> Takashi Iwai suggested this fix, which initializes the substreams<br /> structure right after allocation, so that if we hit the error<br /> paths we avoid trying to cleanup uninitialized data.<br /> <br /> Note: I have not yet managed to reproduce the issue myself, so<br /> this patch has had limited testing.<br /> <br /> Feedback or thoughts would be appreciated!