In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/page_reporting: use system_freezable_wq to fix UAF during suspend<\/p>\n
During PM freeze (e.g. S3 suspend or S4 hibernation), device drivers like
\nvirtio_balloon reset their underlying virtio devices and delete their
\nvirtqueues via vdev->config->del_vqs().<\/p>\n
However, page reporting work (page_reporting_process) was scheduled on the
\nglobal system_wq. Because system_wq lacks the WQ_FREEZABLE flag, the PM
\nfreezer skips it, leaving page_reporting_process active during suspend.<\/p>\n
If pages are freed into the buddy allocator while suspending (for example,
\nwhen core MM invokes the balloon shrinker during S4 hibernation image
\nsaving), page reporting triggers virtballoon_free_page_report() on deleted
\nvirtqueues, resulting in a Use-After-Free \/ General Protection Fault:<\/p>\n
[ 196.795226] general protection fault, probably for non-canonical address 0xaa1436fe70dae6df: 0000 [#1] SMP NOPTI
\n [ 196.825967] Workqueue: events page_reporting_process
\n [ 196.831038] RIP: 0010:virtqueue_add_split+0x233\/0x4c0 [virtio_ring]
\n [ 196.927073] virtballoon_free_page_report+0x3a\/0xe0 [virtio_balloon]
\n [ 196.946943] page_reporting_process+0x370\/0x4f0<\/p>\n
Fix this by switching page reporting work to system_freezable_wq. This
\nensures that the PM freezer pauses page_reporting_process before device
\ndrivers destroy their reporting virtqueues. Because the reporting worker
\nis frozen, memory reclamation\/freeing (e.g. via shrinker execution) can
\nsafely return pages to MM during freeze without triggering unfrozen
\nreporting work on deleted virtqueues.<\/p>\n
This aligns with the driver’s existing design. The comment in
\nvirtballoon_freeze() states:
\n \/*
\n * The workqueue is already frozen by the PM core before this
\n * function is called.
\n *\/<\/p>\n
Testing:
\nI have verified these fixes using Google\u2019s virtualization infrastructure
\nby running continuous suspend\/resume iterations (40+ cycles) while
\nchurning memory using stress-ng (`stress-ng –vm 4 –vm-bytes 60%
\n–timeout 1`) to constantly create free pages for the buddy allocator. We
\nalso set the `page_reporting_order` parameter to 0 to make the page
\nreporting worker highly sensitive, forcing it to pick up any 4K free
\npages. This confirmed that the UAF crashes are no longer reproducible.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mm\/page_reporting: use system_freezable_wq to fix UAF during suspend<\/p>\n
During PM freeze (e.g. S3 suspend or S4 hibernation), device<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7474","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7474","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7474"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7474"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7474"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}