Re: [PATCH v2] vmw_balloon: fixing double free when batching mode is off

[Nadav Amit]

Nadav Amit <namit@xxxxxxxxxx> wrote:

> Nadav Amit <namit@xxxxxxxxxx> wrote:
> 
>> From: Gil Kupfer <gilkup@xxxxxxxxx>
>> 
>> The balloon.page field is used for two different purposes if batching is
>> on or off. If batching is on, the field point to the page which is used
>> to communicate with with the hypervisor. If it is off, balloon.page
>> points to the page that is about to be (un)locked.
>> 
>> Unfortunately, this dual-purpose of the field introduced a bug: when the
>> balloon is popped (e.g., when the machine is reset or the balloon driver
>> is explicitly removed), the balloon driver frees, unconditionally, the
>> page that is held in balloon.page.  As a result, if batching is
>> disabled, this leads to double freeing the last page that is sent to the
>> hypervisor.
> 
> Oleksandr, if you can confirm that it fixes the bug you encountered, it
> would be great.
> 
> Greg, Arnd, on your free time, please let me know if there is any issue
> with the patch, and whether you can incorporate it, preferably in 4.16,
> since it is a bug-fix that was encountered by Red-Hat customers.

Ping?