Re: [PATCH] xen/xenbus: Don't leak memory when unmapping the ring on HVM backend

From: Boris Ostrovsky
Date: Mon Aug 10 2015 - 14:38:57 EST

On 08/10/2015 02:10 PM, Julien Grall wrote:
The commit ccc9d90a9a8b5c4ad7e9708ec41f75ff9e98d61d "xenbus_client:
Extend interface to support multi-page ring" removes the call to
free_xenballooned_pages in xenbus_unmap_ring_vfree_hvm.

This will result to not give back the pages to Linux and loose them
forever. It only happens when the backends are running in HVM domains.

Signed-off-by: Julien Grall <julien.grall@xxxxxxxxxx>

Reviewed-by: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>

Cc: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
Cc: Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
Cc: David Vrabel <david.vrabel@xxxxxxxxxx>
Cc: Wei Liu <wei.liu2@xxxxxxxxxx>

Appeared in Linux 4.1. HVM backend, which is always the case on ARM, will
leak every mapped ring (i.e ~12KB per domain with 1 disk and 1 vif).
drivers/xen/xenbus/xenbus_client.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 9ad3272..e303535 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -814,8 +814,10 @@ static int xenbus_unmap_ring_vfree_hvm(struct xenbus_device *dev, void *vaddr)
rv = xenbus_unmap_ring(dev, node->handles, node->nr_handles,
- if (!rv)
+ if (!rv) {
+ free_xenballooned_pages(node->nr_handles, node->hvm.pages);
+ }
WARN(1, "Leaking %p, size %u page(s)\n", vaddr,

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at