From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 220823570AD for ; Sun, 5 Jul 2026 19:13:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783278784; cv=none; b=ptHuZwJYKSF5bbMszw5RSz48IGck7oUAuINY4+ybYhrKn9Qw1vTcSaQ8vhfA13fbkaGGp0pl49747sxi+mkASesTraBySU0C3xuWWeLpFtXbhT96WlVT3tifV9gmA1SFD2VA2lzbpCCImKCTDllkJfD2j/zTrOz0D1vrSWrp9DM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783278784; c=relaxed/simple; bh=bxZuprF1sYCFOSFNfYLjeOb8S+aS3zOpK6MAxVL/xHA=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=HP/W8x3C5+C5BIxAsKJQL0EpPw2bvKy6xUpi4CcTjpR6KZ/6e6cvkHYdY4OHCuxSpYvphiD/znEwfxY/UmCP1hwg5m5fAa1Jx0Zc1S3jJSJ38/0XA61ZQTefsL8aut0LGveszPdxAqwg6HdmoiH4CSHJKggoa+uRTLxs3LRFiSs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Ro2xtQ1m; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=s5FSWzmp; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Ro2xtQ1m"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="s5FSWzmp" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783278782; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type; bh=0lF1I4MmcKv/IoVfeZbzTgrU3xgP0uy4UImjIzL59PI=; b=Ro2xtQ1mSb8wWZ9wtlQDLtQm4pJ49MDS7Ko14P2ltPL13PZp8i1GJEdCguz45/RzUzMSNj cYlwOrs7xLOnSyeHqYJe/8tpyWIqEky92Kh9cdMOB7O03UkFyhRCqp20ikEqtBzx/+3hDj 22vWoHgpLNUVaI5Zq938c27kkE7rNVw= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-642-n0rBFUn8M7-53rmn1_e8TQ-1; Sun, 05 Jul 2026 15:13:01 -0400 X-MC-Unique: n0rBFUn8M7-53rmn1_e8TQ-1 X-Mimecast-MFC-AGG-ID: n0rBFUn8M7-53rmn1_e8TQ_1783278780 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-493ce08a6b4so23696655e9.1 for ; Sun, 05 Jul 2026 12:13:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1783278780; x=1783883580; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=0lF1I4MmcKv/IoVfeZbzTgrU3xgP0uy4UImjIzL59PI=; b=s5FSWzmplSBxvEgArLA50K5jrMP0E1VxedfYHPW/CaRnMbjzo4RgEymK1ifR0d627S eO+Jh7bp2kh1j8BVcpm3/oIdt4X78pW5pPWgK6hdHa1LfN2M1rkPtjTTrjSvTBMsOOtW k4mCpdKAfhX/gcfadsxmAoZ0Lps8WyNzSSuIKoxObj5c64OHH2P+imGVvoE9uc30I6Ru xUtXHSNuTlbjYNu+mApiUvR3F2stDJAULOFxylu19IsM37GSFTS/LjpdvorCX8Yy0evP sILKPqGGIR8sAGRk6VuIyavIwQP+D7kZ27lX17XVxTsTfFG6Cb/N/YwN7f15r5NScs89 Zl2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783278780; x=1783883580; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=0lF1I4MmcKv/IoVfeZbzTgrU3xgP0uy4UImjIzL59PI=; b=JGAS2iSbWXpSMdq2DqF0VFfv2x6lTfYot6i/sfofX9HvTO0JaeFNV7w6Gudf2U74nO JL0mp5rXKp2t+bs53nDZaHm8FCOAK4VOkxi/vyBn/lj7kSDnIZvh5puWkplCd7Ea7nfX 0QI1ImhRXdFwQ6i1s1oS1U2mNjwmIocXkyflviiWgNkXzdBdIzEJ8ouZ0AVQpb7BUJO9 ruRdwYpb0jkk6SZ7wks3efAktwYzZcAiY5aTV3rsrokuWLSF+VBYVF7jbvRD2tKMCT3M 4nmodSpI73pAijDW2ClUMyoCw2P92eCRvbf0NN6UL9BXGyi1oPjVVtNwlIxPx20FPm57 ML6g== X-Gm-Message-State: AOJu0Yy9zwsv91Lyb1ZBWhKLrx4h/0Wmo8CR3KYVO3BPCYsPjqgsraRo 6cTr0wB2IpWyGwpkibmjyhtmuHURTKPDtv5zN9DRZSQmPQtgjWng4DjoAg324DA2xQ9zbNwNqQZ GgvcDQ1R0aWYjmvnH93Mnq2GnwySCETQ+LbzdCQNRaQXPAhizIIg9kgsYW+KI31RgbSSrG4Ipfk 0wrUYFsb8tr6KYjkagRsgD/trULe/VfLmQhckLOwmBYVQ= X-Gm-Gg: AfdE7clxB6SJdLnAdjmGNTUYwbaFtmpTl5Y9rHTz2wOjG2dfONDYZ2TXbljWQQCj0p1 kamunMMbXUbsJ4uUndUcUMHXKXTLrtkSoXDtxpmoyUJee9ke+nX5XyEAt+y0LFZUefupNlOnSZj 2AgweUs7lnBS4JUSo0XMb0rFduvLKkxqWdVHm9zDADwd486tCtJJXQnCVo5WIqB1cpQYQtO20zy mkfu04mtUjLh8RwSHjMiQu0t4nev51U2KcQEZnQ//ALEtTMuf/gyWFKWP7QVnuk0UUdTrxqICoN STvfFmqA5HdkUpv/tCVNmoRkGmyQMqbAPKXOyITCgv/soaY/PhuDG0DR54+0JuHY6iPMv4LJsN7 +rnIFYNnP1Wbe1EhaDy4JjIAhTaEGZGYo X-Received: by 2002:a05:600c:3484:b0:493:bd73:c77a with SMTP id 5b1f17b1804b1-493d11f6d05mr90533145e9.29.1783278777558; Sun, 05 Jul 2026 12:12:57 -0700 (PDT) X-Received: by 2002:a05:600c:3484:b0:493:bd73:c77a with SMTP id 5b1f17b1804b1-493d11f6d05mr90532895e9.29.1783278776999; Sun, 05 Jul 2026 12:12:56 -0700 (PDT) Received: from redhat.com (IGLD-80-230-68-31.inter.net.il. [80.230.68.31]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493ccb4cafesm212002865e9.0.2026.07.05.12.12.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 05 Jul 2026 12:12:55 -0700 (PDT) Date: Sun, 5 Jul 2026 15:12:53 -0400 From: "Michael S. Tsirkin" To: linux-kernel@vger.kernel.org Cc: David Hildenbrand , Jason Wang , Xuan Zhuo , Eugenio =?utf-8?B?UMOpcmV6?= , Adam Litke , Rusty Russell , virtualization@lists.linux.dev, Andrew Morton , linux-mm@kvack.org Subject: [PATCH v2] virtio_balloon: prime stats vq after virtio_device_ready() Message-ID: <2f0d0de033f3005d3b985883be3e5cf37b3f6c42.1783278596.git.mst@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Mailer: git-send-email 2.51.2.2891.g4157995a80.dirty X-Mutt-Fcc: =sent The virtio spec requires the driver not to kick the device before DRIVER_OK is set. init_vqs() primes the stats virtqueue with a buffer and kicks the device before virtio_device_ready() is called in virtballoon_probe(), violating this requirement. Further, if the device responds to the early kick by processing the buffer before DRIVER_OK, stats_request() fires and queues update_balloon_stats_work. Should probe then fail and free vb, the work runs against freed memory. To fix, move buffer setup to after DRIVER_OK. Be careful to disable update_balloon_stats_work while this is going on, to make sure it does not race with the setup. setup_vqs() warns but does not fail probe or restore if virtqueue_add_outbuf() fails; the call never actually fails in these contexts since the queue is freshly initialized and empty. Testing: tested that stats still work after the change. Fixes: 9564e138b1f6 ("virtio: Add memory statistics reporting to the balloon driver (V4)") Reported-by: Sashiko:gemini-3.1-pro-preview Cc: David Hildenbrand Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Michael S. Tsirkin --- changes from v1: check that work enable/disable is balanced explain how add buf never fails in probe/restore drivers/virtio/virtio_balloon.c | 50 +++++++++++++++++++++------------ 1 file changed, 32 insertions(+), 18 deletions(-) diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c index 088b3a0e6ce6..bc0a2b19ca7d 100644 --- a/drivers/virtio/virtio_balloon.c +++ b/drivers/virtio/virtio_balloon.c @@ -611,25 +611,8 @@ static int init_vqs(struct virtio_balloon *vb) vb->inflate_vq = vqs[VIRTIO_BALLOON_VQ_INFLATE]; vb->deflate_vq = vqs[VIRTIO_BALLOON_VQ_DEFLATE]; if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_STATS_VQ)) { - struct scatterlist sg; - unsigned int num_stats; vb->stats_vq = vqs[VIRTIO_BALLOON_VQ_STATS]; - - /* - * Prime this virtqueue with one buffer so the hypervisor can - * use it to signal us later (it can't be broken yet!). - */ - num_stats = update_balloon_stats(vb); - - sg_init_one(&sg, vb->stats, sizeof(vb->stats[0]) * num_stats); - err = virtqueue_add_outbuf(vb->stats_vq, &sg, 1, vb, - GFP_KERNEL); - if (err) { - dev_warn(&vb->vdev->dev, "%s: add stat_vq failed\n", - __func__); - return err; - } - virtqueue_kick(vb->stats_vq); + disable_work(&vb->update_balloon_stats_work); } if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) @@ -916,6 +899,33 @@ static int virtio_balloon_register_shrinker(struct virtio_balloon *vb) return 0; } +static void setup_vqs(struct virtio_balloon *vb) +{ + struct scatterlist sg; + unsigned int num_stats; + bool ret; + + if (!virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_STATS_VQ)) + return; + + /* + * Prime this virtqueue with one buffer so the hypervisor can + * use it to signal us later (it can't be broken yet!). + */ + num_stats = update_balloon_stats(vb); + sg_init_one(&sg, vb->stats, sizeof(vb->stats[0]) * num_stats); + if (virtqueue_add_outbuf(vb->stats_vq, &sg, 1, vb, GFP_KERNEL)) { + dev_warn(&vb->vdev->dev, "%s: add stat_vq failed\n", __func__); + return; + } + virtqueue_kick(vb->stats_vq); + + ret = enable_and_queue_work(system_freezable_wq, + &vb->update_balloon_stats_work); + /* Make sure we balanced enable/disable, or we won't report stats. */ + BUG_ON(!ret); +} + static int virtballoon_probe(struct virtio_device *vdev) { struct virtio_balloon *vb; @@ -1059,6 +1069,8 @@ static int virtballoon_probe(struct virtio_device *vdev) virtio_device_ready(vdev); + setup_vqs(vb); + if (towards_target(vb)) virtballoon_changed(vdev); return 0; @@ -1148,6 +1160,8 @@ static int virtballoon_restore(struct virtio_device *vdev) virtio_device_ready(vdev); + setup_vqs(vb); + if (towards_target(vb)) virtballoon_changed(vdev); update_balloon_size(vb); -- MST