From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C4475377A8E for ; Tue, 14 Jul 2026 18:52:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784055174; cv=none; b=Qc44x4IBC3juYVFa+nMft3XGJTRDuQkdETaIWGgi9uBsCDBc/eSpbnBnQrWt+pY+n2ZTtbH5n0L+RNFcsdM7tplRuVQF6bFTrgV4HjF2oui0Uv0jOXXUh+7tyeW2ufVQK8u9wUaZhb34n4+3C1WXy1hAbwGdm0WmMVrsen/levY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784055174; c=relaxed/simple; bh=1xwTUh0XQqqeQexWpf4nYNoBpFIntTgU7ikkAM9WIvM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=AGBoRaVDFXAVQ6PWrXV8inuSfKwTcUco2co7nne2V/f9WzXQeGMbw6smeVw7jAaQ+oNiJCCq9q6k2DEwfdz8sisKu/Kx245bXxN6W2gPlq1gye1MxMJ5PRq6Mk/ErvOaz2LX/lc/daHqiZ8s3h9qQ48OqGjSEgiJ0NbYYn6kheQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=E5P7tl/P; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=dlOOdpNq; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="E5P7tl/P"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="dlOOdpNq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784055166; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=nIfwW/o8U7z/0oL+ZaQUBUaHVA8qfCLS7p9kgkBe1fQ=; b=E5P7tl/PNNBJ8792MzO+4vTw3bMLor51GYVwXMOiF09RLfYbdEGbj6S7QlIoNrffCiwsj3 Kt5ydwVKQcvVd6SpMhsFDT4ZmVa3zClS9TAQ3K75aK8C2hp0N4Y+BajzVWkfFwwRcBhYQ6 L7rBAwlCHCbNBhnvGfxO4ufEr71GFdk= Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-83-jrYESPfuPrCy2K--piXNsA-1; Tue, 14 Jul 2026 14:52:43 -0400 X-MC-Unique: jrYESPfuPrCy2K--piXNsA-1 X-Mimecast-MFC-AGG-ID: jrYESPfuPrCy2K--piXNsA_1784055162 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-4744b72f90bso2445059f8f.0 for ; Tue, 14 Jul 2026 11:52:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1784055162; x=1784659962; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=nIfwW/o8U7z/0oL+ZaQUBUaHVA8qfCLS7p9kgkBe1fQ=; b=dlOOdpNq4HKcX111TjfaRAlQv5lgzphm7aSghlnSZLOYTY3SB9kNvDWgyCpmn2//0+ 64oCBpIttXIm/BjlH+3r3XNxQ2ivtqOeg0lA6yE1riX1tt+V5v7gNUydNNV1+vtkVyvG FP2PFJ9lHGk62b71n90S0Xngqq6T1ATtmC/I9YfsdzAdel1CG5a6qHKNTXOHApUnebZb eoVQs6m9o33WBbMR8Dh9pP3rF0p0s9skSXZjWzCWZzReckPGgfP0hyQrx93WBPbktYEx +2eQJw/tkeqKrMLXUumguRape9p3jQ8M2May7UsTGG1uSpRhJwBpbtCW2B0s2c6K5vYL 9hhw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784055162; x=1784659962; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=nIfwW/o8U7z/0oL+ZaQUBUaHVA8qfCLS7p9kgkBe1fQ=; b=tSw+ZWDPqVqaHE/b3OwNlpTtlTHuvAKKmJCTXxr0wNN2HdCPNhnN07deXWHLkT04tN VyAf9phymDrBXv7PLudoXBUKXXIrq0EZmAVJLMVl1NSBKiCQ0xBFyx3ahxSqBSW8fuxS vU3jN1Wz/7MpgpAw4CS3xrNQWZLvDWH3ofrK37kRdzrs6kIqTOXjX1zDdOuA2+KTnQRI 8SCtCTbRw13lB9LnNvJbMHIftaFxZyNTUEYRbboZZyGNVKUVUtLqM2yg6JsTzffzTZ5L PP8YxRJYrGagChwIQy/m3NjTdWdeFPbJ9NR1miyTOp+TxLYD70QOXB4chV/lhU+fz55h DVsw== X-Forwarded-Encrypted: i=1; AHgh+RppABNINMtOf2donlHNcPSZQXrMU7opXHyeLqMMX+mqt1TNZ/VOMzj1NN6YUqAI1S5N+39+udW6HIsPYKc=@vger.kernel.org X-Gm-Message-State: AOJu0YwTw/xd2HpC+AYvQ+8IamtLSkVauRuNLgpLzaxAYn/I1mseCFoz ZVgKE7knMQRoqiuiuWaAchJcumV+GA7FxhA6amKV+9zX78XCTlQ3edO6IPWpAjOmxabYT2oq6oq GCf7hSev8lC4bi2Ft52+wQFXqzPK/Xop1xgnBirFRMPSYswAbGUw3chKNJAEnsnTaep5oLAr/Yw == X-Gm-Gg: AfdE7cnpiFp1mnaaRd83NKdppJR2FlCkBBmAM+r53zef+i8MBqM34/tuVGnRD1n+RM8 eXLT4QCB0yMAlVSJL+rgTIgOQIs0AKOHU1O8My0Z+njvBzSrjEbISBdmn/VoaYOywz21z0Q8A0n /S5GzdbHdgerhTqCjrqTGGZbEJJzV7PAX0IT2gOQ9MjZpWc4e+uCwM7P1XpwXth5VzIgTHB2kE/ VsbIokdDtBf/IqcXM1uh3j9EpwWNVrK9uFdnmnYgZn7zDi27Bw8yMIWOypk88ZrJfagi6K3CcM6 qyYGJsVGFsbQ3RT7sdLlGvEacnPZM5+/rAHlDAFqB6S0+iMztBKdewA9Qq6dcs+2gg6TvssO54M CtxtRouq0vmV1TudrynVNcQhKlp0EJP9LNBY= X-Received: by 2002:a5d:5f49:0:b0:462:6aa1:4393 with SMTP id ffacd0b85a97d-47f4886edc6mr4094725f8f.4.1784055161946; Tue, 14 Jul 2026 11:52:41 -0700 (PDT) X-Received: by 2002:a5d:5f49:0:b0:462:6aa1:4393 with SMTP id ffacd0b85a97d-47f4886edc6mr4094699f8f.4.1784055161476; Tue, 14 Jul 2026 11:52:41 -0700 (PDT) Received: from redhat.com (IGLD-80-230-24-117.inter.net.il. [80.230.24.117]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f464a9879sm11237677f8f.22.2026.07.14.11.52.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 11:52:40 -0700 (PDT) Date: Tue, 14 Jul 2026 14:52:37 -0400 From: "Michael S. Tsirkin" To: David Rientjes Cc: "David Hildenbrand (Arm)" , Link Lin , Andrew Morton , Vlastimil Babka , virtualization@lists.linux.dev, linux-mm@kvack.org, linux-kernel@vger.kernel.org, prasin@google.com, duenwen@google.com, jasowang@redhat.com, xuanzhuo@linux.alibaba.com, Ammar Faizi , jiaqiyan@google.com, ahwilkins@google.com, Greg Thelen , Alexander Duyck , stable@vger.kernel.org Subject: Re: [RFC] virtio_balloon: fix Use-After-Free in page reporting during PM freeze Message-ID: <20260714145155-mutt-send-email-mst@kernel.org> References: <20260709224330.946683-1-linkl@google.com> <8d316b6c-41fb-4ae3-8923-3b649b92b33d@kernel.org> <20260714092146-mutt-send-email-mst@kernel.org> <5e18d7ec-a9d7-2cc3-7741-695ec3580ffa@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5e18d7ec-a9d7-2cc3-7741-695ec3580ffa@google.com> On Tue, Jul 14, 2026 at 11:21:33AM -0700, David Rientjes wrote: > On Tue, 14 Jul 2026, Michael S. Tsirkin wrote: > > > > > diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c > > > > index a1b2c3d4e5f6..45a90fb3abf8 100640 > > > > --- a/drivers/virtio/virtio_balloon.c > > > > +++ b/drivers/virtio/virtio_balloon.c > > > > @@ -1055,6 +1055,9 @@ static int virtballoon_freeze(struct virtio_device *vdev) > > > > * The workqueue is already frozen by the PM core before this > > > > * function is called. > > > > */ > > > > + if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_REPORTING)) > > > > + page_reporting_unregister(&vb->pr_dev_info); > > > > + > > > > remove_common(vb); > > > > return 0; > > > > } > > > > > > > > static int virtballoon_restore(struct virtio_device *vdev) > > > > { > > > > struct virtio_balloon *vb = vdev->priv; > > > > int ret; > > > > > > > > ret = init_vqs(vdev->priv); > > > > if (ret) > > > > return ret; > > > > > > > > virtio_device_ready(vdev); > > > > > > > > + if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_REPORTING)) { > > > > + ret = page_reporting_register(&vb->pr_dev_info); > > > > + if (ret) > > > > + goto out_remove_vqs; > > > > + } > > > > > > Hm, that failure handling is rather nasty. > > > > > > > > > In virtballoon_freeze() we document: > > > > > > "The workqueue is already frozen by the PM core before this function is called" > > > > > > Your report states: > > > > > > "Workqueue: events page_reporting_process" > > > > > > > > > I assume that workqueue is not frozen yet because ... it's not freezable :) > > > > > > So could we queue to system_freezable_wq instead, or define our own freezable > > > workqueue there? Then a driver doesn't have to worry about that. > > > > > > -- > > > Cheers, > > > > > > David > > > > +1. Just system_freezable_wq will do the trick. > > > > This makes sense. > > I'm curious why this bug hasn't popped up earlier, presumably any VM that > has gone through suspend while reporting free pages through FPR is > vulnerable to it and could have panicked as a result. Which would suggest > maybe >99% of FPR is done by guests that never suspend? Quite possible. > While under > pressure this issue seems reproducible.