Re: [RFC] virtio_balloon: fix Use-After-Free in page reporting during PM freeze

[Link Lin]

On Tue, Jul 14, 2026 at 11:05 AM Link Lin <linkl@xxxxxxxxxx> wrote:
>
> Per the earlier feedback to keep these fixes independent, I'll format
> v2 as a 3-part patch series:
>   [PATCH v2 1/3] mm/page_reporting: use system_freezable_wq
>   [PATCH v2 2/3] virtio_balloon: fix shrinker UAF during PM freeze
>   [PATCH v2 3/3] virtio_balloon: fix OOM notifier UAF during PM freeze
>
> I'll send that out shortly.

Hi everyone,

I have just sent out the v2 patch series in a new thread:
https://lore.kernel.org/all/20260717002311.681748-1-linkl@xxxxxxxxxx/

Just a quick update: I previously mentioned I would include a fix for
the OOM notifier as part 3. However, upon further audit, the PM core
explicitly disables the OOM killer (via oom_killer_disable()) during
freeze_processes() before device drivers are frozen.

Therefore, the virtio_balloon_oom_notify callback cannot trigger while
the virtqueues are deleted. Since it is already safe, I dropped it
from the series.

v2 now consists solely of the page reporting workqueue migration and
the shrinker TOCTOU fix. Thanks again for the reviews!

Best,
Link