In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
virtio_balloon: quiesce balloon work before device shutdown<\/p>\n
Commit 8bd2fa086a04 (“virtio: break and reset virtio devices on
\ndevice_shutdown()”) added a generic virtio bus .shutdown handler that
\nbreaks and resets every virtio device during device_shutdown(), i.e. on
\nreboot and kexec.<\/p>\n
virtio_balloon provides no .shutdown of its own, so that generic path
\nruns while the balloon’s asynchronous work is still armed. Once the
\ndevice has been broken, virtqueue_add_inbuf() in
\nvirtballoon_free_page_report() returns -EIO and trips its
\nWARN_ON_ONCE(). On a kernel booted with panic_on_warn that turns an
\nordinary reboot, for example a kexec based upgrade, into a fatal panic
\nin the middle of device_shutdown(), so the machine never reaches the
\nnew kernel.<\/p>\n
Relaxing that single WARN_ON_ONCE() would only hide the symptom: the
\ninflate\/deflate and OOM paths do not warn, they call
\nwait_event(vb->acked, …) and would instead block forever on a broken
\nqueue that can no longer complete. The device has to be quiesced, not
\njust kept quiet.<\/p>\n
Add a .shutdown handler that quiesces the balloon via the shared
\nvirtballoon_quiesce() helper while the device is still alive, and only
\nthen breaks and resets it via virtio_device_shutdown(). Unlike
\nvirtballoon_remove() the balloon workqueue is not destroyed, as shutdown
\ndoes not free the device and cancel_work_sync() together with stop_update
\nalready prevent any further work from being queued.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
virtio_balloon: quiesce balloon work before device shutdown<\/p>\n
Commit 8bd2fa086a04 (“virtio: break and reset virtio devices on
\ndevice<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25538","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25538","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}