During system power management freeze (e.g. ACPI S3 suspend or S4
hibernation), virtballoon_freeze() calls remove_common() to reset the
virtio device and delete all virtqueues via vdev->config->del_vqs().
However, unlike virtballoon_remove(), virtballoon_freeze() fails to call
page_reporting_unregister(&vb->pr_dev_info).
The comment in virtballoon_freeze() states:
/*
* The workqueue is already frozen by the PM core before this
* function is called.
*/
While this comment was accurate in 2011 for balloon-internal workqueues
(such as balloon_wq, which was created with WQ_FREEZABLE and is paused
by the PM freezer), it is invalid for Free Page Reporting.
Free Page Reporting (mm/page_reporting.c) schedules its delayed work
(prdev->work) on the global system_wq. Because system_wq lacks the
WQ_FREEZABLE flag, the PM freezer (freeze_workqueues_busy()) explicitly
skips it. Consequently, page_reporting_process() on system_wq remains
active and unfrozen throughout device suspend.
If memory is freed into the buddy allocator or a delayed work timer
expires while the device is being frozen, page_reporting_process() fires
on system_wq and calls virtballoon_free_page_report(). This function
passes vb->reporting_vq into virtqueue_add_inbuf() / virtqueue_add_split().
Because the virtqueues were already destroyed by del_vqs(), this results
in a Use-After-Free / General Protection Fault:
[ 250.709271] general protection fault, probably for non-canonical address
0x7f728084daf08d5e: 0000 [#1] SMP PTI
[ 250.732967] CPU: 2 PID: 38 Comm: kworker/2:1 Not tainted
5.10.0-44-cloud-amd64 #1 Debian 5.10.257-1
[ 250.751575] Workqueue: events page_reporting_process
[ 250.756665] RIP: 0010:virtqueue_add_split+0x233/0x4c0 [virtio_ring]
...
[ 250.867678] virtballoon_free_page_report+0x3a/0xe0 [virtio_balloon]
[ 250.883446] page_reporting_process+0x225/0x4f0
(Note: The OOM Notifier and Shrinker/Free Page Hinting features suffer
from an identical lifecycle flaw and are also vulnerable to UAFs during
S4 hibernation when memory pressure spikes. This patch focuses on Free
Page Reporting, which runs periodically, to ensure clean backports to
stable kernels).
Fix this by:
1. Unregistering page reporting in virtballoon_freeze() prior to calling
remove_common(). This clears the RCU pr_dev_info pointer and flushes/
cancels prdev->work on system_wq via cancel_delayed_work_sync().
2. Re-registering page reporting in virtballoon_restore() after the
virtqueues are re-initialized and virtio_device_ready() has been called.
3. Unwinding virtqueue initialization via remove_common() in
virtballoon_restore() if page_reporting_register() fails.
Fixes: 924a663f75e2 ("virtio-balloon: Reporting free page reservations")
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: Ammar Faizi <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: Greg Thelen <[email protected]>
Cc: Alexander Duyck <[email protected]>
Signed-off-by: Link Lin <[email protected]>
---
drivers/virtio/virtio_balloon.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index a1b2c3d4e5f6..45a90fb3abf8 100640
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -1055,6 +1055,9 @@ static int virtballoon_freeze(struct virtio_device *vdev)
* The workqueue is already frozen by the PM core before this
* function is called.
*/
+ if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_REPORTING))
+ page_reporting_unregister(&vb->pr_dev_info);
+
remove_common(vb);
return 0;
}
static int virtballoon_restore(struct virtio_device *vdev)
{
struct virtio_balloon *vb = vdev->priv;
int ret;
ret = init_vqs(vdev->priv);
if (ret)
return ret;
virtio_device_ready(vdev);
+ if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_REPORTING)) {
+ ret = page_reporting_register(&vb->pr_dev_info);
+ if (ret)
+ goto out_remove_vqs;
+ }
+
if (towards_target(vb))
virtballoon_changed(vdev);
update_balloon_size(vb);
return 0;
+
+out_remove_vqs:
+ remove_common(vb);
+ return ret;
}
--
2.45.0
