[PATCH] virt: vboxguest: fix use-after-free in balloon work

[PATCH] virt: vboxguest: fix use-after-free in balloon work

[Fan Wu]

VMMDEV_EVENT_BALLOON_CHANGE_REQUEST is reported only after a guest
userspace client enables it with VBOXGUEST_IOCTL_SET_EVENT_FILTER.
The interrupt handler then queues the balloon work, which reads and
writes the mem_balloon.get_req and change_req request buffers.

vbg_pci_remove() calls free_irq() before vbg_core_exit(), but
free_irq() only waits for the handler to return, not for any work it
has queued.  A balloon work still running on system_wq therefore
touches the request buffers after vbg_core_exit() has freed them:

  CPU 0 (remove)          IRQ handler              system_wq
  free_irq()              schedule_work(...)
                         return
  vbg_core_exit()
    vbg_req_free(...)                             vbg_balloon_work()
                                                   req->event_ack = ...

Fix this by calling cancel_work_sync() on mem_balloon.work in
vbg_core_exit(), before the request buffers are freed.  The worker
does not requeue itself, and the interrupt handler, the only place
that queues it, can no longer run when vbg_core_exit() is reached:
vbg_pci_remove() has already called free_irq(), and on the probe
error path the irq was never requested.  Draining the work once is
therefore sufficient.

This issue was found by an in-house static analysis tool.

Fixes: 0ba002bc4393 ("virt: Add vboxguest driver for Virtual Box Guest integration")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/virt/vboxguest/vboxguest_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index b177a534b6a4..884e69d00f72 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -1048,6 +1048,8 @@ int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events)
  */
 void vbg_core_exit(struct vbg_dev *gdev)
 {
+	cancel_work_sync(&gdev->mem_balloon.work);
+
 	vbg_heartbeat_exit(gdev);
 	vbg_guest_mappings_exit(gdev);
 
-- 
2.34.1

Re: [PATCH] virt: vboxguest: fix use-after-free in balloon work

[Hans de Goede]

Hi,

On 18-Aug-26 10:11, Fan Wu wrote:
> VMMDEV_EVENT_BALLOON_CHANGE_REQUEST is reported only after a guest
> userspace client enables it with VBOXGUEST_IOCTL_SET_EVENT_FILTER.
> The interrupt handler then queues the balloon work, which reads and
> writes the mem_balloon.get_req and change_req request buffers.
> 
> vbg_pci_remove() calls free_irq() before vbg_core_exit(), but
> free_irq() only waits for the handler to return, not for any work it
> has queued.  A balloon work still running on system_wq therefore
> touches the request buffers after vbg_core_exit() has freed them:
> 
>   CPU 0 (remove)          IRQ handler              system_wq
>   free_irq()              schedule_work(...)
>                          return
>   vbg_core_exit()
>     vbg_req_free(...)                             vbg_balloon_work()
>                                                    req->event_ack = ...
> 
> Fix this by calling cancel_work_sync() on mem_balloon.work in
> vbg_core_exit(), before the request buffers are freed.  The worker
> does not requeue itself, and the interrupt handler, the only place
> that queues it, can no longer run when vbg_core_exit() is reached:
> vbg_pci_remove() has already called free_irq(), and on the probe
> error path the irq was never requested.  Draining the work once is
> therefore sufficient.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: 0ba002bc4393 ("virt: Add vboxguest driver for Virtual Box Guest integration")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

Thanks, patch looks good to me:

Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>

Regards,

Hans




> ---
>  drivers/virt/vboxguest/vboxguest_core.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
> index b177a534b6a4..884e69d00f72 100644
> --- a/drivers/virt/vboxguest/vboxguest_core.c
> +++ b/drivers/virt/vboxguest/vboxguest_core.c
> @@ -1048,6 +1048,8 @@ int vbg_core_init(struct vbg_dev *gdev, u32 fixed_events)
>   */
>  void vbg_core_exit(struct vbg_dev *gdev)
>  {
> +	cancel_work_sync(&gdev->mem_balloon.work);
> +
>  	vbg_heartbeat_exit(gdev);
>  	vbg_guest_mappings_exit(gdev);
>