On Thu, 9 Jul 2026, Link Lin wrote: > > > Fix this by: > > > 1. Unregistering page reporting in virtballoon_freeze() prior to calling > > > remove_common(). This clears the RCU pr_dev_info pointer and flushes/ > > > cancels prdev->work on system_wq via cancel_delayed_work_sync(). > > > 2. Re-registering page reporting in virtballoon_restore() after the > > > virtqueues are re-initialized and virtio_device_ready() has been > > > called. > > > 3. Unwinding virtqueue initialization via remove_common() in > > > virtballoon_restore() if page_reporting_register() fails. > > > > AI review thinks the patch didn't do the above: > > > > https://sashiko.dev/#/patchset/[email protected] > > The AI reviewer might not have parsed the entirety of the fix I proposed. > The patch submitted definitely includes the changes to virtballoon_restore() > for steps 2 and 3 (re-registering page reporting and unwinding init_vqs > on failure). It seems the AI failed to parse the diff correctly. See: > > + if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_REPORTING)) { > + ret = page_reporting_register(&vb->pr_dev_info); > + if (ret) > + goto out_remove_vqs; > + } > + > if (towards_target(vb)) > virtballoon_changed(vdev); > update_balloon_size(vb); > return 0; > + > +out_remove_vqs: > + remove_common(vb); > + return ret; > } > > > It also might have found a couple of pre-existing bugs in there. > > Indeed. Regarding the first pre-existing bug found by the AI (leaving the > OOM notifier registered during suspend, leading to a UAF if memory pressure > spikes during S4 hibernation): > > I actually addressed this in the commit message: > > "(Note: The OOM Notifier and Shrinker/Free Page Hinting features suffer > from an identical lifecycle flaw and are also vulnerable to UAFs during > S4 hibernation when memory pressure spikes. This patch focuses on Free > Page Reporting, which runs periodically, to ensure clean backports to > stable kernels)." > > Regarding the second pre-existing bug the AI flagged (leaving uncancelled > works on system_freezable_wq if virtballoon_restore fails on the cold path): > the AI is correct that this asynchronous work cancellation failure exists. > > Since these are separate, pre-existing lifecycle bugs, would you prefer I > roll fixes for the OOM notifier, shrinker/free page hinting, and work > cancellations into a v2 of this patch, or submit them as a separate patch > series to keep the stable backports clean? >
I think it would be best to have separate patches for each fix; Andrew, please correct me if you'd prefer one patch to address everything.
