[lkml]   [2018]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH v2] vmw_balloon: fixing double free when batching mode is off
Nadav Amit <> wrote:

> Nadav Amit <> wrote:
>> From: Gil Kupfer <>
>> The field is used for two different purposes if batching is
>> on or off. If batching is on, the field point to the page which is used
>> to communicate with with the hypervisor. If it is off,
>> points to the page that is about to be (un)locked.
>> Unfortunately, this dual-purpose of the field introduced a bug: when the
>> balloon is popped (e.g., when the machine is reset or the balloon driver
>> is explicitly removed), the balloon driver frees, unconditionally, the
>> page that is held in As a result, if batching is
>> disabled, this leads to double freeing the last page that is sent to the
>> hypervisor.
> Oleksandr, if you can confirm that it fixes the bug you encountered, it
> would be great.
> Greg, Arnd, on your free time, please let me know if there is any issue
> with the patch, and whether you can incorporate it, preferably in 4.16,
> since it is a bug-fix that was encountered by Red-Hat customers.


 \ /
  Last update: 2018-03-19 19:53    [W:0.337 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site