Nadav Amit namit@vmware.com wrote:
Nadav Amit namit@vmware.com wrote:
From: Gil Kupfer gilkup@gmail.com
The balloon.page field is used for two different purposes if batching is on or off. If batching is on, the field point to the page which is used to communicate with with the hypervisor. If it is off, balloon.page points to the page that is about to be (un)locked.
Unfortunately, this dual-purpose of the field introduced a bug: when the balloon is popped (e.g., when the machine is reset or the balloon driver is explicitly removed), the balloon driver frees, unconditionally, the page that is held in balloon.page. As a result, if batching is disabled, this leads to double freeing the last page that is sent to the hypervisor.
Oleksandr, if you can confirm that it fixes the bug you encountered, it would be great.
Greg, Arnd, on your free time, please let me know if there is any issue with the patch, and whether you can incorporate it, preferably in 4.16, since it is a bug-fix that was encountered by Red-Hat customers.
Ping?