Balloon submits at most 1-2 scatter-gather entries per buffer and virtqueue sizes are 128+, so indirect descriptors are unnecessary.
Disabling them avoids a GFP_KERNEL allocation inside virtqueue_add_sgs when VIRTIO_RING_F_INDIRECT_DESC is negotiated. This allocation could trigger OOM reclaim while balloon_lock is held, leading to a deadlock: OOM notifier -> leak_balloon -> balloon_lock. With single-buffer submissions (previous patch) and no indirect descriptors, virtqueue_add never allocates memory. Signed-off-by: Michael S. Tsirkin <[email protected]> Assisted-by: Claude:claude-opus-4-6 --- drivers/virtio/virtio_balloon.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c index 53b4a3984e7d..1fa1c7fa285f 100644 --- a/drivers/virtio/virtio_balloon.c +++ b/drivers/virtio/virtio_balloon.c @@ -7,6 +7,7 @@ */ #include <linux/virtio.h> +#include <uapi/linux/virtio_ring.h> #include <linux/virtio_balloon.h> #include <linux/swap.h> #include <linux/workqueue.h> @@ -1175,6 +1176,13 @@ static int virtballoon_validate(struct virtio_device *vdev) else if (!virtio_has_feature(vdev, VIRTIO_BALLOON_F_PAGE_POISON)) __virtio_clear_bit(vdev, VIRTIO_BALLOON_F_REPORTING); + /* + * Balloon submits 1-2 sg entries max per buffer, virtqueue + * sizes are 128+. Disable indirect descriptors to avoid + * GFP_KERNEL allocation in virtqueue_add under balloon_lock, + * which could deadlock via OOM -> oom_notify -> leak_balloon. + */ + __virtio_clear_bit(vdev, VIRTIO_RING_F_INDIRECT_DESC); __virtio_clear_bit(vdev, VIRTIO_F_ACCESS_PLATFORM); return 0; } -- MST
