virtio_balloon: vtballoon_update_stats called from kthread without the serializer it requires
Summary
vtballoon_update_stats opens with ASSERT_SERIALIZED(VTBALLOON_SLZ(sc)) at 551 and shares stats vq with vtballoon_stats_vq_intr (dequeues under serializer at 581-594). Sole live caller vtballoon_thread at 868 invokes WITHOUT acquiring sc->vtballoon_slz - thread drops serializer via vtballoon_sleep (840) before calling. Comment at 346 documents dev hit this panic and worked around by #if 0 priming at 346-354. Stats path dormant because priming disabled. Re-enabling: INVARIANTS panic immediately; production: unsynchronized virtqueue_enqueue (566) vs virtqueue_dequeue (593) corrupts vq_desc_head_idx/vq_free_cnt/vq_descx. Fix: VTBALLOON_ENTER/EXIT_SLZ around 868.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1706 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Acquire VTBALLOON_SLZ around vtballoon_update_stats call in the thread. | 450 B | view raw |
| VERDICT.md | verdict | full analysis | 1.2 KB | ↓ raw |
DF-1706 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/virtual/virtio/balloon/virtio_balloon.c:551,868.
Mechanism
vtballoon_update_stats asserts ASSERT_SERIALIZED but the sole live caller (vtballoon_thread:868) invokes without acquiring the serializer. Dormant (priming disabled) but would corrupt vq state or panic on INVARIANTS if re-enabled.
Fix
Acquire VTBALLOON_SLZ around vtballoon_update_stats call in the thread.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
virtio_balloon.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- v
- i
- r
- t
- u
- a
- l
- /
- v
- i
- r
- t
- i
- o
- /
- b
- a
- l
- l
- o
- o
- n
- /
- v
- i
- r
- t
- i
- o
- _
- b
- a
- l
- l
- o
- o
- n
- .
- c
- :
- 5
- 5
- 1
- s
- y
- s
- /
- d
- e
- v
- /
- v
- i
- r
- t
- u
- a
- l
- /
- v
- i
- r
- t
- i
- o
- /
- b
- a
- l
- l
- o
- o
- n
- /
- v
- i
- r
- t
- i
- o
- _
- b
- a
- l
- l
- o
- o
- n
- .
- c
- :
- 8
- 6
- 8
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/virtual/virtio/balloon/virtio_balloon.c:551,868. Fix compiled clean.
PoC changes
authored fix.diff: VTBALLOON_ENTER/EXIT_SLZ around update_stats call
Verified recommended fix
Acquire serializer around vtballoon_update_stats in thread. Matches finding proposal.
Verdict
REPRODUCED (source-only). vtballoon_update_stats requires serializer but thread calls without acquiring it. Dormant but corrupts vq state or INVARIANTS panic if re-enabled.
No comments yet.