> init_vqs() arms the stats virtqueue callback, so an update work can
> already be queued on the system freezable workqueue while
> virtballoon_probe() is still running. If a later probe step fails, the
> error unwind deletes the virtqueues and frees vb without stopping the
> works, and the queued work runs after the balloon struct is gone:
>
> BUG: KFENCE: use-after-free read in virtqueue_get_buf_ctx
> update_balloon_stats_func+0x121/0x300
> Workqueue: events_freezable update_balloon_stats_func
>
> remove() already handles this via virtballoon_quiesce(). Factor the
> stopping of the update works out of it and run it on the probe error
> path as well, before the queues and vb go away.
>
> The same hole exists when init_vqs() itself fails after
> [ ... ]
> Fixes: fad7b7b27b6a ("virtio_balloon: Use a workqueue instead of "vballoon"
> kthread")
> Fixes: 74cf5b169c4c ("virtio-balloon: remove BUG() in init_vqs")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=0f659760bac1ecb01812
> Signed-off-by: Mingbing Zhai <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
