On Thu, Jul 16, 2026 at 5:24 PM Link Lin <[email protected]> wrote: > > During PM freeze (e.g. S4 hibernation), virtballoon_freeze() calls > remove_common() which resets the virtio device and deletes all virtqueues. > However, the balloon shrinker remains registered with core MM. > > If memory pressure occurs during S4 hibernation image creation/saving, MM > invokes virtio_balloon_shrinker_scan(), which attempts to reclaim free > pages. Although return_free_pages_to_mm() only frees pages back to MM, > reclaiming free pages under memory pressure can trigger page reporting > which might access the deleted reporting virtqueue if it is not yet > frozen, or interact with other parts of the driver in a teardown state. > > Avoid this by adding a `suspended` flag to `struct virtio_balloon`. Set > this flag to true in virtballoon_freeze() and false in > virtballoon_restore(). Check this flag in both shrinker callbacks (scan > and count) and return 0 if the device is suspended, preventing any > shrinker execution while virtqueues are deleted. Wrap the lockless reads > in READ_ONCE() and writes in WRITE_ONCE() to prevent compiler > optimization issues and KCSAN data race warnings. > > Fixes: 71019de8219b ("virtio_balloon: Add free page hinting support") > Cc: [email protected] > Acked-by: David Rientjes <[email protected]> > Signed-off-by: Link Lin <[email protected]>
Apologies, I missed adding a tag for the feedback that led to the TOCTOU locking fix in this patch. Maintainers, if this series is applied, could you please add the following? Suggested-by: James Houghton <[email protected]> (I will be sure to include it if a v3 is otherwise required).
