From: "David Hildenbrand (Arm)" <david@kernel.org>
To: Link Lin <linkl@google.com>,
Andrew Morton <akpm@linux-foundation.org>,
Vlastimil Babka <vbabka@kernel.org>,
"Michael S . Tsirkin" <mst@redhat.com>
Cc: virtualization@lists.linux.dev, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, prasin@google.com,
rientjes@google.com, duenwen@google.com, jasowang@redhat.com,
xuanzhuo@linux.alibaba.com,
Ammar Faizi <ammarfaizi2@openresty.com>,
jiaqiyan@google.com, ahwilkins@google.com,
Greg Thelen <gthelen@google.com>,
Alexander Duyck <alexander.duyck@gmail.com>,
jthoughton@google.com, stable@vger.kernel.org
Subject: Re: [PATCH v2 2/2] virtio_balloon: avoid shrinker execution during PM suspend
Date: Fri, 17 Jul 2026 11:30:44 +0200 [thread overview]
Message-ID: <29457fe7-0fe6-4bc0-81a8-9e67f85b3a3a@kernel.org> (raw)
In-Reply-To: <20260717002311.681748-3-linkl@google.com>
On 7/17/26 02:22, Link Lin wrote:
> During PM freeze (e.g. S4 hibernation), virtballoon_freeze() calls
> remove_common() which resets the virtio device and deletes all virtqueues.
> However, the balloon shrinker remains registered with core MM.
>
> If memory pressure occurs during S4 hibernation image creation/saving, MM
> invokes virtio_balloon_shrinker_scan(), which attempts to reclaim free
> pages. Although return_free_pages_to_mm() only frees pages back to MM,
> reclaiming free pages under memory pressure can trigger page reporting
> which might access the deleted reporting virtqueue if it is not yet
> frozen, or interact with other parts of the driver in a teardown state.
Yes, this does seem possible.
> +
> static void virtio_balloon_queue_free_page_work(struct virtio_balloon *vb)
> {
> if (!virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
> @@ -871,6 +887,9 @@ static unsigned long virtio_balloon_shrinker_scan(struct shrinker *shrinker,
> {
> struct virtio_balloon *vb = shrinker->private_data;
>
> + if (READ_ONCE(vb->suspended))
> + return 0;
> +
> return shrink_free_pages(vb, sc->nr_to_scan);
> }
>
> @@ -879,6 +898,9 @@ static unsigned long virtio_balloon_shrinker_count(struct shrinker *shrinker,
> {
> struct virtio_balloon *vb = shrinker->private_data;
>
> + if (READ_ONCE(vb->suspended))
> + return 0;
> +
> return vb->num_free_page_blocks * VIRTIO_BALLOON_HINT_BLOCK_PAGES;
> }
>
> @@ -1089,8 +1111,11 @@ static void remove_common(struct virtio_balloon *vb)
> update_balloon_size(vb);
>
> /* There might be free pages that are being reported: release them. */
> - if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
> - return_free_pages_to_mm(vb, ULONG_MAX);
> + if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
> + spin_lock_irq(&vb->free_page_list_lock);
> + __return_free_pages_to_mm(vb, ULONG_MAX);
> + spin_unlock_irq(&vb->free_page_list_lock);
> + }
Why not set the boolean immediately after this, and call it "shrinker_disabled"
instead of "suspended"?
Then you can keep calling "return_free_pages_to_mm(vb, ULONG_MAX);" here.
--
Cheers,
David
prev parent reply other threads:[~2026-07-17 9:30 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-17 0:22 [PATCH v2 0/2] virtio_balloon: fix Use-After-Free bugs during PM freeze Link Lin
2026-07-17 0:22 ` [PATCH v2 1/2] mm/page_reporting: use system_freezable_wq to fix UAF during suspend Link Lin
2026-07-17 9:09 ` David Hildenbrand (Arm)
2026-07-17 9:17 ` Michael S. Tsirkin
2026-07-17 0:22 ` [PATCH v2 2/2] virtio_balloon: avoid shrinker execution during PM suspend Link Lin
2026-07-17 3:08 ` Link Lin
2026-07-17 9:17 ` Michael S. Tsirkin
2026-07-17 9:30 ` David Hildenbrand (Arm) [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=29457fe7-0fe6-4bc0-81a8-9e67f85b3a3a@kernel.org \
--to=david@kernel.org \
--cc=ahwilkins@google.com \
--cc=akpm@linux-foundation.org \
--cc=alexander.duyck@gmail.com \
--cc=ammarfaizi2@openresty.com \
--cc=duenwen@google.com \
--cc=gthelen@google.com \
--cc=jasowang@redhat.com \
--cc=jiaqiyan@google.com \
--cc=jthoughton@google.com \
--cc=linkl@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mst@redhat.com \
--cc=prasin@google.com \
--cc=rientjes@google.com \
--cc=stable@vger.kernel.org \
--cc=vbabka@kernel.org \
--cc=virtualization@lists.linux.dev \
--cc=xuanzhuo@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox