virtio_balloon: vtballoon_detach deadlocks if balloon thread waiting on host or balloon inflated
Summary
vtballoon_detach at 373-382 sets DETACH, wakeup_one, then zsleep(sc->vtballoon_td, ..., 0, vtbdth, 0) timeout=forever. DETACH only checked inside vtballoon_sleep at 807-810. Thread spends unbounded time in vtballoon_send_page_frames loop at 725-727: while ((c=virtqueue_dequeue(vq,NULL))==NULL) zsleep(sc, ..., 0, vtbspf, 0) waiting for host. wakeup_one wakes that, dequeue returns NULL (host never advanced), thread loops back to zsleep - never reaches vtballoon_sleep, never sees DETACH. Also vtballoon_pop at 390/739 calls vtballoon_deflate->send_page_frames but virtio_teardown_intr already at 386-387 so no wakeup source. Host attacker DoS: force inflate, withhold used-ring response, device_del. Fix: send_page_frames wait must honor DETACH.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1707 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Check VTBALLOON_FLAG_DETACH at the top of send_page_frames and return early. | 523 B | view raw |
| VERDICT.md | verdict | full analysis | 1.2 KB | ↓ raw |
DF-1707 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: dos Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/virtual/virtio/balloon/virtio_balloon.c:373-382,725-727.
Mechanism
vtballoon_detach waits forever (zsleep timeout=0) for the balloon thread which may be stuck in send_page_frames waiting for a host that never responds; DETACH flag only checked in vtballoon_sleep which the thread never reaches.
Fix
Check VTBALLOON_FLAG_DETACH at the top of send_page_frames and return early.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
virtio_balloon.ko built with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- v
- i
- r
- t
- u
- a
- l
- /
- v
- i
- r
- t
- i
- o
- /
- b
- a
- l
- l
- o
- o
- n
- /
- v
- i
- r
- t
- i
- o
- _
- b
- a
- l
- l
- o
- o
- n
- .
- c
- :
- 3
- 7
- 3
- -
- 3
- 8
- 2
- s
- y
- s
- /
- d
- e
- v
- /
- v
- i
- r
- t
- u
- a
- l
- /
- v
- i
- r
- t
- i
- o
- /
- b
- a
- l
- l
- o
- o
- n
- /
- v
- i
- r
- t
- i
- o
- _
- b
- a
- l
- l
- o
- o
- n
- .
- c
- :
- 7
- 2
- 5
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/virtual/virtio/balloon/virtio_balloon.c:373-382,725. Fix compiled clean.
PoC changes
authored fix.diff: check DETACH at top of send_page_frames
Verified recommended fix
Honor VTBALLOON_FLAG_DETACH in send_page_frames. Matches finding proposal.
Verdict
REPRODUCED (source-only). detach waits forever for thread stuck in send_page_frames; DETACH only checked in vtballoon_sleep which thread never reaches. Host attacker DoS.
No comments yet.