Nadav Amit <namit@xxxxxxxxxx> wrote: > Nadav Amit <namit@xxxxxxxxxx> wrote: > >> From: Gil Kupfer <gilkup@xxxxxxxxx> >> >> The balloon.page field is used for two different purposes if batching is >> on or off. If batching is on, the field point to the page which is used >> to communicate with with the hypervisor. If it is off, balloon.page >> points to the page that is about to be (un)locked. >> >> Unfortunately, this dual-purpose of the field introduced a bug: when the >> balloon is popped (e.g., when the machine is reset or the balloon driver >> is explicitly removed), the balloon driver frees, unconditionally, the >> page that is held in balloon.page. As a result, if batching is >> disabled, this leads to double freeing the last page that is sent to the >> hypervisor. > > Oleksandr, if you can confirm that it fixes the bug you encountered, it > would be great. > > Greg, Arnd, on your free time, please let me know if there is any issue > with the patch, and whether you can incorporate it, preferably in 4.16, > since it is a bug-fix that was encountered by Red-Hat customers. Ping?