From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8E87331ECD for ; Tue, 14 Jul 2026 18:21:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784053297; cv=none; b=dO1fAC1e9JCIKTQ3Ck94k/XMaxEq53KhsO6KuXb3fTiECCtQ/Ejv69k/xc9Dej3qyVY3su5Q6PbdcYokZNKWJeK3CfrSA8K1td2UfwhBBHjwVFCSJULL/10xi4dKS8fjGHIIg2wjtM0fE8DjJ/ce4fD9r5OWbOza7EXWKlUsn2E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784053297; c=relaxed/simple; bh=A38XAf/qyrY/pxvb8R0wLZ2ECalCATFuHuqBr7PPTyE=; h=Date:From:To:cc:Subject:In-Reply-To:Message-ID:References: MIME-Version:Content-Type; b=mKZlqsz2ou6ACddoEPoTmmyVSIL6VKxAnGoWFD5iWvJzc/BsTp76mYUo45Uynx1KMLXFCYYKEYTm38u1rdnZeC50ajd4fpPG3Z+7Iv07Zih+iXHbSUZ/4HReVdUj1ZTGIfkDlK2DswHmoO56gIKRoA9mTQi/MbrZ/PFmJno2O5g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=o0Y9bBjA; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="o0Y9bBjA" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2cab97c86bdso171015ad.1 for ; Tue, 14 Jul 2026 11:21:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1784053295; x=1784658095; darn=vger.kernel.org; h=content-type:mime-version:references:message-id:in-reply-to:subject :cc:to:from:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=8gQRzGlj1G5cVe9CASOoXX9GLstMyJGv9XUVp1m4BJc=; b=o0Y9bBjA1irEA1R+qCmHg6L6NkE+kAzrZa6mpuZr22P2QQmSgpLEvx7urMD9HrogTf kRclH7khQYfIwbSzN03RNzN7mCVsZLs6XO692BxzMMTFFJMn93WC7CHCMJUXC6vNE1bG H5TkhZwpugYDGrCXZjjv+mMQvDJ5ZP5IGFAF0xb+g8EoPfNZ0wwV0FHl8mDa+MKkOIIC C9Qd3LSGKVlL+REX5ObtMYHs5FZgWYzQclvpA+8KusFHlVfSSIbE2WDiYDwYigKTNnwX o5LTqAsXPm88Tv16XPjdC3vrfWRxXTtMe2iPrD/fo2Z3WcDMoqbSBxUxQHRaZTRveh0+ FRmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784053295; x=1784658095; h=content-type:mime-version:references:message-id:in-reply-to:subject :cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8gQRzGlj1G5cVe9CASOoXX9GLstMyJGv9XUVp1m4BJc=; b=rc6+DvUBaG2SAiXbeghKae0czGIwzV7nzUK/MF/zEnKxy2HTuoONGI3/zwKNl/cwxx LSWWiA8NH/X4sndf7UlejXoFy1EKgToSwgJ04NUsxdNQH+je706E4todPb3Ntxt976Qf 6IoBr1uI/7kJ07r7a5wiixwG5I6QUx3k4/JTqI9x1Kjc+fskk5SRUH5I9qwzZ4QjqTiP ZBa+roMm3ITGBsxWgVpuTyLaTk9KHYFTtL99Kvok9e/y/R1g0hupIulEAw7onfi7AfuZ TdYlSwqEz+com2j+49dHIVsfPsjmIna2nOzoBF8owNDo2bZMrJqgJDk4smk0PQrnJbGJ F4ZA== X-Forwarded-Encrypted: i=1; AHgh+RqWr6U7/yj160h1WLcsDk3M3p6NPhZfettka5L4+rtZ127DZJWAPUhop12in40tUJu7spdnnBDZqeqfuq8=@vger.kernel.org X-Gm-Message-State: AOJu0YykXNQvv5zlIm+O1U7qElHNQ7IxYix6hS8KXiG3HrFcKTfKsswM 9fQ3nkq+tMSRL0Vv923A6/MZtLpcLc6gX/Ujjr2ehxelItJLhLcALy56utrev+jo6A== X-Gm-Gg: AfdE7cm4D/S/V1U+NY578vXUzfgUhW0+b0mzip030MsDRkUJca0aeWExE0EVlyqyNDq 4EfM/ApYg6y73ZgieIeTYkeo01Ms0Ge7I1gGAj3higEJOjGMgYJX0JRlNocA6REgOVRrCB+41fI ZY8mhrHmG+LFE2JuLL6osIM6YkOExbEvbumeOBWpsBhzVG/bKpIumuaIuUoDeQ1qXYCWdE/5V6i ARg0b7K+llIkcbgxuy7qDuZhKARV64VYd3gDZcrTmz38hk+88zEpS2kUsic7iJtsx0r5PJEmkYP Z+Vd6IzMQ37WhPJyF75MwbwndYhSls1si9teLuZfxwZL6up7FKna5FlHgZltiHhEhS721FdrFJa acY7/MDSpxPAtK7pVxb1zYWxA+JYcR62rFKiio/at/TMk2OF6ksSrN13ZaeiXK5C7MEun15YxDg qnBuR/6rz/LTawbj8kc5gYraQXW3Py7N9rbTT+NW6/ZUwvOaCaL/MkK9Z23q1vnmV5HsJvFpxNg MI5R7EKpOk9i11dRCjT5tIF0jVm8G/tUCP3plPBJVw= X-Received: by 2002:a17:902:f70b:b0:2cc:6df5:62a1 with SMTP id d9443c01a7336-2cee1ca3115mr7223455ad.20.1784053294748; Tue, 14 Jul 2026 11:21:34 -0700 (PDT) Received: from [2a00:79e0:2eb4:9:c2bd:d216:2ddc:2568] ([2a00:79e0:2eb4:9:c2bd:d216:2ddc:2568]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e172cc7f1sm1933730a91.5.2026.07.14.11.21.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 11:21:33 -0700 (PDT) Date: Tue, 14 Jul 2026 11:21:33 -0700 (PDT) From: David Rientjes To: "Michael S. Tsirkin" cc: "David Hildenbrand (Arm)" , Link Lin , Andrew Morton , Vlastimil Babka , virtualization@lists.linux.dev, linux-mm@kvack.org, linux-kernel@vger.kernel.org, prasin@google.com, duenwen@google.com, jasowang@redhat.com, xuanzhuo@linux.alibaba.com, Ammar Faizi , jiaqiyan@google.com, ahwilkins@google.com, Greg Thelen , Alexander Duyck , stable@vger.kernel.org Subject: Re: [RFC] virtio_balloon: fix Use-After-Free in page reporting during PM freeze In-Reply-To: <20260714092146-mutt-send-email-mst@kernel.org> Message-ID: <5e18d7ec-a9d7-2cc3-7741-695ec3580ffa@google.com> References: <20260709224330.946683-1-linkl@google.com> <8d316b6c-41fb-4ae3-8923-3b649b92b33d@kernel.org> <20260714092146-mutt-send-email-mst@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII On Tue, 14 Jul 2026, Michael S. Tsirkin wrote: > > > diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c > > > index a1b2c3d4e5f6..45a90fb3abf8 100640 > > > --- a/drivers/virtio/virtio_balloon.c > > > +++ b/drivers/virtio/virtio_balloon.c > > > @@ -1055,6 +1055,9 @@ static int virtballoon_freeze(struct virtio_device *vdev) > > > * The workqueue is already frozen by the PM core before this > > > * function is called. > > > */ > > > + if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_REPORTING)) > > > + page_reporting_unregister(&vb->pr_dev_info); > > > + > > > remove_common(vb); > > > return 0; > > > } > > > > > > static int virtballoon_restore(struct virtio_device *vdev) > > > { > > > struct virtio_balloon *vb = vdev->priv; > > > int ret; > > > > > > ret = init_vqs(vdev->priv); > > > if (ret) > > > return ret; > > > > > > virtio_device_ready(vdev); > > > > > > + if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_REPORTING)) { > > > + ret = page_reporting_register(&vb->pr_dev_info); > > > + if (ret) > > > + goto out_remove_vqs; > > > + } > > > > Hm, that failure handling is rather nasty. > > > > > > In virtballoon_freeze() we document: > > > > "The workqueue is already frozen by the PM core before this function is called" > > > > Your report states: > > > > "Workqueue: events page_reporting_process" > > > > > > I assume that workqueue is not frozen yet because ... it's not freezable :) > > > > So could we queue to system_freezable_wq instead, or define our own freezable > > workqueue there? Then a driver doesn't have to worry about that. > > > > -- > > Cheers, > > > > David > > +1. Just system_freezable_wq will do the trick. > This makes sense. I'm curious why this bug hasn't popped up earlier, presumably any VM that has gone through suspend while reporting free pages through FPR is vulnerable to it and could have panicked as a result. Which would suggest maybe >99% of FPR is done by guests that never suspend? While under pressure this issue seems reproducible.