LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Nadav Amit <namit@vmware.com>
To: Arnd Bergmann <arnd@arndb.de>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Oleksandr Natalenko <onatalen@redhat.com>
Cc: Xavier Deguillard <xdeguillard@vmware.com>,
	pv-drivers <pv-drivers@vmware.com>,
	LKML <linux-kernel@vger.kernel.org>,
	Gil Kupfer <gilkup@gmail.com>,
	"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: Re: [PATCH v2] vmw_balloon: fixing double free when batching mode is off
Date: Wed, 14 Mar 2018 04:02:31 +0000	[thread overview]
Message-ID: <E63288C3-BE4F-4D41-A074-1CB86C74414E@vmware.com> (raw)
In-Reply-To: <20180312192848.22104-1-namit@vmware.com>

Nadav Amit <namit@vmware.com> wrote:

> From: Gil Kupfer <gilkup@gmail.com>
> 
> The balloon.page field is used for two different purposes if batching is
> on or off. If batching is on, the field point to the page which is used
> to communicate with with the hypervisor. If it is off, balloon.page
> points to the page that is about to be (un)locked.
> 
> Unfortunately, this dual-purpose of the field introduced a bug: when the
> balloon is popped (e.g., when the machine is reset or the balloon driver
> is explicitly removed), the balloon driver frees, unconditionally, the
> page that is held in balloon.page.  As a result, if batching is
> disabled, this leads to double freeing the last page that is sent to the
> hypervisor.

Oleksandr, if you can confirm that it fixes the bug you encountered, it
would be great.

Greg, Arnd, on your free time, please let me know if there is any issue
with the patch, and whether you can incorporate it, preferably in 4.16,
since it is a bug-fix that was encountered by Red-Hat customers.

Thanks,
Nadav

  reply	other threads:[~2018-03-14  4:02 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-03-12 19:19 [PATCH] " Nadav Amit
2018-03-12 19:28 ` [PATCH v2] " Nadav Amit
2018-03-14  4:02   ` Nadav Amit [this message]
2018-03-14  7:41     ` Oleksandr Natalenko
2018-03-19 18:52     ` Nadav Amit
2018-03-20  7:21       ` Oleksandr Natalenko
2018-03-22 20:02         ` Nadav Amit
2018-03-23  8:42           ` Oleksandr Natalenko
2018-04-16 11:36             ` Oleksandr Natalenko
2018-04-18 17:54               ` Nadav Amit
2018-04-19  6:38                 ` Greg Kroah-Hartman
2018-04-19 18:17                   ` [PATCH v3] " Nadav Amit
2018-04-30 17:30                     ` Nadav Amit
2018-05-04 11:26                       ` Oleksandr Natalenko
2018-05-30  1:21                       ` Nadav Amit
2018-05-31 20:56                         ` Nadav Amit
2018-06-01  7:59                           ` Greg Kroah-Hartman
2018-06-01 15:00                             ` Nadav Amit
2018-06-01  7:47                               ` [PATCH v3 RESEND] " Nadav Amit

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=E63288C3-BE4F-4D41-A074-1CB86C74414E@vmware.com \
    --to=namit@vmware.com \
    --cc=arnd@arndb.de \
    --cc=gilkup@gmail.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=onatalen@redhat.com \
    --cc=pv-drivers@vmware.com \
    --cc=stable@vger.kernel.org \
    --cc=xdeguillard@vmware.com \
    --subject='Re: [PATCH v2] vmw_balloon: fixing double free when batching mode is off' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).