On 7/17/26 02:22, Link Lin wrote:
> During PM freeze (e.g. S4 hibernation), virtballoon_freeze() calls
> remove_common() which resets the virtio device and deletes all virtqueues.
> However, the balloon shrinker remains registered with core MM.
>
> If memory pressure occurs during S4 hibernation image creation/saving, MM
> invokes virtio_balloon_shrinker_scan(), which attempts to reclaim free
> pages. Although return_free_pages_to_mm() only frees pages back to MM,
> reclaiming free pages under memory pressure can trigger page reporting
> which might access the deleted reporting virtqueue if it is not yet
> frozen, or interact with other parts of the driver in a teardown state.
Yes, this does seem possible.
> +
> static void virtio_balloon_queue_free_page_work(struct virtio_balloon *vb)
> {
> if (!virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
> @@ -871,6 +887,9 @@ static unsigned long virtio_balloon_shrinker_scan(struct
> shrinker *shrinker,
> {
> struct virtio_balloon *vb = shrinker->private_data;
>
> + if (READ_ONCE(vb->suspended))
> + return 0;
> +
> return shrink_free_pages(vb, sc->nr_to_scan);
> }
>
> @@ -879,6 +898,9 @@ static unsigned long virtio_balloon_shrinker_count(struct
> shrinker *shrinker,
> {
> struct virtio_balloon *vb = shrinker->private_data;
>
> + if (READ_ONCE(vb->suspended))
> + return 0;
> +
> return vb->num_free_page_blocks * VIRTIO_BALLOON_HINT_BLOCK_PAGES;
> }
>
> @@ -1089,8 +1111,11 @@ static void remove_common(struct virtio_balloon *vb)
> update_balloon_size(vb);
>
> /* There might be free pages that are being reported: release them. */
> - if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
> - return_free_pages_to_mm(vb, ULONG_MAX);
> + if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
> + spin_lock_irq(&vb->free_page_list_lock);
> + __return_free_pages_to_mm(vb, ULONG_MAX);
> + spin_unlock_irq(&vb->free_page_list_lock);
> + }
Why not set the boolean immediately after this, and call it "shrinker_disabled"
instead of "suspended"?
Then you can keep calling "return_free_pages_to_mm(vb, ULONG_MAX);" here.
--
Cheers,
David
