From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D2C601F4181 for ; Fri, 17 Jul 2026 09:17:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784279874; cv=none; b=gUllptoUIszFKeN9BM9FrB2uTNsRdWFbFs+4Tq39b+06OT1+FsA+PUginlWmFV5vwXUROGOLCrNZalTINJsxKI9/qUnWdXNr+peCbFsCFUavAufh40wWZUgg/AGuZbkXbJIDmjzcX6vuI55HShnxIBoBfhbjZgIBybUEQVxDoHw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784279874; c=relaxed/simple; bh=opKalTvfBSXyILj0RJsThfYwW8d3Q9Qy1589DrgLROI=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=VYTx7wo+tZCeGc9JS39OoqNRE7X/A/rQqwHr5LYwr8umoMOl1ETADkMBwC9H8vrMaYe3bNXTxuuk6uPRtSiPFSXWPguXYzaSuY4gYQJzZetqYc8ikkdOPx4oAtwkuvVSdUcmuVh9IgfrDPxsrhmAHZSD1BMvnI62mcuTlQBUQXk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=bsfRQEQ6; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=kjVlQJzf; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="bsfRQEQ6"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="kjVlQJzf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784279869; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=W3388yjdx5mxv0Xwh51fsD72bz8HgdGVi3PgcMelqQI=; b=bsfRQEQ6IfwH0KlaGluGujcXxhPeUtlO+EglEhM3YPqk6QWuiBjHwriK4UJPsFGCaZBxoB z7Eu3qROQQlE1ty81+r+ouJHli4FRLmkNAVYuX/cbfrSMqWaQTDCKbFpVjq4tSIuL0Q80f 2gI+QHIfsQ1xpXnD5U/ZIDEWh/Xs4yA= Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-322-SRHrqjRWN7y0K7f7dLcnVA-1; Fri, 17 Jul 2026 05:17:48 -0400 X-MC-Unique: SRHrqjRWN7y0K7f7dLcnVA-1 X-Mimecast-MFC-AGG-ID: SRHrqjRWN7y0K7f7dLcnVA_1784279867 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-4729d2a64efso798701f8f.0 for ; Fri, 17 Jul 2026 02:17:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1784279867; x=1784884667; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=W3388yjdx5mxv0Xwh51fsD72bz8HgdGVi3PgcMelqQI=; b=kjVlQJzfcVkCLFkRTWkuOS8tp+jKbqJZvVN8UBxN21+LG3oUcZo0NzVRklg0t4rXP9 oO+plIKenBe9wCM5nKosDkKW0lgRcRo2TDL0XI5XzQ1cSSbOF1DcODFtnR8RcCQ3MPfN qYJcZ6a5aBOTc6qmrQUxVNj4YGYt1ZiSCqpSDQHHoXegk9ktseCsHf8vt7kH1tAI0y4r dfc1GOXZSVkOD+PBOvoC/YY+NQkd6xF2Lh015cFiEb2Hi73RM+y6lhJiOVrSszhl0fTu ocVD+oQTt+aV6B5VAuG9l3Xsozt5zSbfW3zKKUIE7/3pijDjRCkZ5Eelvzn9bFhIm+H4 rgKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784279867; x=1784884667; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=W3388yjdx5mxv0Xwh51fsD72bz8HgdGVi3PgcMelqQI=; b=QCbuNbCqZDtdh/d7QzY9a10HqIxSt3QZ4so7VEHY463FMAgjAQNnTmDb6cB0vTqzdO b5k4do4L34m0qQMMGRJj1+3aG+ep3fFR1RAwEl/139keqiBoxtJd4hGocLwUEEj8Ch9Y whGQoypuU3IKCVOoHBQXwEIeXPlDpHYeROPNgZI/HaGwS+JtImqkLwjLs9QZGVIKOA15 QmKXgm6Fj4iU6BpcHr7GrlPloVtlc7vbGVCNVrwrzIdz++2bmEs01gCz9h0AEMPZleT/ /4dG2YXmbH4baNUTVUZ7MdqK/NFPvLbLRR7jRi4y2ks10CBhWft3g6Lffx9PmiUXmc1O UAvw== X-Forwarded-Encrypted: i=1; AHgh+RpBoH5SxVcM02Y2wvn57qLVutVwNRMM1VWpWycr5KMY657aYS1T3KNFmFk4O4vuvV+DJx20or0hFievcFE=@vger.kernel.org X-Gm-Message-State: AOJu0Yxo7RBoxHpNDVYQEiGBG3f6C/EK2Jr90wpGFmtU6gTQ+mli2dcP roHg92ZC4WUbaC7R/UIgzsVWyXF5ylHr8gpadoB3XpAIprPmoHppUz8EAXxSzH885GIKvsAuSLP 0+1YGBDRl4/NqVQFic6RvxNqFVzIiSoxfq5G+TqumMkVgi4pbgXQ9Oell3s+W3PlvDQ== X-Gm-Gg: AfdE7ckaTVpw1nuGDwkVCZCTv8UFRSjU0LVMiC9/VNWfgc4rRk4a3Zr5h//tvd7QyP2 Ka4OqWc5MVis01Ok9JHLaSNED27sGbS/PEWbDon1ueSi88RPBzo+Pmq3nkWpVuGAT3XvowiBItF 2+vLdT4zIcrwac/5X1/VjnaLYDTKRhg4QwoFpAOyVmAbWGo+17Rol5nBiwTHeAcCAWhoT4uPKd9 8awa46GBGJ79Mzslb5QSAQZbF6xTa5zk87+7Tt4kmFlaAQrJaWjykGo37gcuGVviskQ+Z686Vnv BdzZxNNXwUdpqymRbuUG6ZEcDZ3x7rABKkG+uh1VzGaGmswlNac9t60Ac6kjH83e6tcTOS6hTkU FnfhXZ8KpBd0L4Eb+xqWDZOPD X-Received: by 2002:a05:600c:a210:b0:493:c566:7bd6 with SMTP id 5b1f17b1804b1-4954a341bcdmr11164565e9.18.1784279867118; Fri, 17 Jul 2026 02:17:47 -0700 (PDT) X-Received: by 2002:a05:600c:a210:b0:493:c566:7bd6 with SMTP id 5b1f17b1804b1-4954a341bcdmr11164265e9.18.1784279866477; Fri, 17 Jul 2026 02:17:46 -0700 (PDT) Received: from redhat.com (IGLD-80-230-24-117.inter.net.il. [80.230.24.117]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4954a2692a3sm30866345e9.0.2026.07.17.02.17.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 02:17:46 -0700 (PDT) Date: Fri, 17 Jul 2026 05:17:42 -0400 From: "Michael S. Tsirkin" To: Link Lin Cc: Andrew Morton , Vlastimil Babka , David Hildenbrand , virtualization@lists.linux.dev, linux-mm@kvack.org, linux-kernel@vger.kernel.org, prasin@google.com, rientjes@google.com, duenwen@google.com, jasowang@redhat.com, xuanzhuo@linux.alibaba.com, Ammar Faizi , jiaqiyan@google.com, ahwilkins@google.com, Greg Thelen , Alexander Duyck , jthoughton@google.com, stable@vger.kernel.org, David Hildenbrand Subject: Re: [PATCH v2 1/2] mm/page_reporting: use system_freezable_wq to fix UAF during suspend Message-ID: <20260717051734-mutt-send-email-mst@kernel.org> References: <20260717002311.681748-1-linkl@google.com> <20260717002311.681748-2-linkl@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260717002311.681748-2-linkl@google.com> On Fri, Jul 17, 2026 at 12:22:20AM +0000, Link Lin wrote: > During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like > virtio_balloon reset their underlying virtio devices and delete their > virtqueues via vdev->config->del_vqs(). > > However, page reporting work (page_reporting_process) was scheduled on > the global system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the > PM freezer skips it, leaving page_reporting_process active during > suspend. If pages are freed into the buddy allocator while suspending, > page reporting invokes virtballoon_free_page_report() on deleted > virtqueues: > > [ 196.795226] general protection fault, probably for non-canonical address 0xaa1436fe70dae6df: 0000 [#1] SMP NOPTI > [ 196.825967] Workqueue: events page_reporting_process > [ 196.831038] RIP: 0010:virtqueue_add_split+0x233/0x4c0 [virtio_ring] > [ 196.927073] virtballoon_free_page_report+0x3a/0xe0 [virtio_balloon] > [ 196.946943] page_reporting_process+0x370/0x4f0 > > Fix this by switching page reporting work to system_freezable_wq. This > ensures that the PM freezer pauses page_reporting_process before device > drivers destroy their reporting virtqueues. > > This aligns with the driver's existing design. The comment in > virtballoon_freeze() states: > /* > * The workqueue is already frozen by the PM core before this > * function is called. > */ > > Suggested-by: David Hildenbrand > Suggested-by: Michael S. Tsirkin > Acked-by: David Rientjes > Fixes: 924a663f75e2 ("virtio-balloon: Reporting free page reservations") > Cc: stable@vger.kernel.org > Signed-off-by: Link Lin Acked-by: Michael S. Tsirkin > --- > mm/page_reporting.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/mm/page_reporting.c b/mm/page_reporting.c > index 7418f2e500..4dc6f4b852 100644 > --- a/mm/page_reporting.c > +++ b/mm/page_reporting.c > @@ -80,7 +80,8 @@ __page_reporting_request(struct page_reporting_dev_info *prdev) > * now we are limiting this to running no more than once every > * couple of seconds. > */ > - schedule_delayed_work(&prdev->work, PAGE_REPORTING_DELAY); > + queue_delayed_work(system_freezable_wq, &prdev->work, > + PAGE_REPORTING_DELAY); > } > > /* notify prdev of free page reporting request */ > @@ -343,7 +344,8 @@ static void page_reporting_process(struct work_struct *work) > */ > state = atomic_cmpxchg(&prdev->state, state, PAGE_REPORTING_IDLE); > if (state == PAGE_REPORTING_REQUESTED) > - schedule_delayed_work(&prdev->work, PAGE_REPORTING_DELAY); > + queue_delayed_work(system_freezable_wq, &prdev->work, > + PAGE_REPORTING_DELAY); > } > > static DEFINE_MUTEX(page_reporting_mutex); > -- > 2.55.0.229.g6434b31f56-goog