From nobody Sun Feb 8 12:31:50 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1564067955; cv=none; d=zoho.com; s=zohoarc; b=LuqSuLLf6KIelzddPZknEsGBtFQJISqJ1t2iE7DAEFzTL1ctQP6pxKHaskMJmAUEVYrUsCBHoDvkpb4WUe2+unmbnlWn3mmZn6PMRFZ4WRdmIVoB9H3IYSFwMkqBQNjEGzMmM921Q9xWbKnrnfb0LEJdcnzDiUtoFX0+UxlVlpc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1564067955; h=Content-Type:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To:ARC-Authentication-Results; bh=90Tl041o8ADF/DIqY7fnqH1k25cYZ/IcGAXjvzAUKkU=; b=I8PTCboAN2lMifMlS1B8B9sPSmzTXqgWBi9Yk3Ibv9osw/0aJDq/PLwYlV1ZKDbWrgtmJ41UufKjcQ0L0zLuQn+fSBj+hryh7jTvkdivbotD8fBn37tnxpycN+mgibxrayLCJ2/g0b7HId5m/JiZR/7etq1cFCjkVlA50eF5STk= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1564067955767793.9466090453377; Thu, 25 Jul 2019 08:19:15 -0700 (PDT) Received: from localhost ([::1]:60988 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hqfWU-00084m-PV for importer@patchew.org; Thu, 25 Jul 2019 11:19:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:45899) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hqfWH-0007fw-UD for qemu-devel@nongnu.org; Thu, 25 Jul 2019 11:19:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hqfWG-00020a-Iu for qemu-devel@nongnu.org; Thu, 25 Jul 2019 11:19:01 -0400 Received: from mail-qt1-f193.google.com ([209.85.160.193]:32864) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hqfWG-0001yr-E2 for qemu-devel@nongnu.org; Thu, 25 Jul 2019 11:19:00 -0400 Received: by mail-qt1-f193.google.com with SMTP id r6so45213501qtt.0 for ; Thu, 25 Jul 2019 08:19:00 -0700 (PDT) Received: from redhat.com (bzq-79-181-91-42.red.bezeqint.net. [79.181.91.42]) by smtp.gmail.com with ESMTPSA id x46sm30928525qtx.96.2019.07.25.08.18.56 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Thu, 25 Jul 2019 08:18:58 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition; bh=90Tl041o8ADF/DIqY7fnqH1k25cYZ/IcGAXjvzAUKkU=; b=A9mVyL7FX0L+p27diAga1qYZQP8jqW+OkzaVQaGPiI6HKAYtqABG073ryFhkPx6hmV lHKDDA3mhacidMs2op8C9ELueGdAocEkhRR2r9/FSJdwHHez63GF3darNSVDdoKWbkW6 kcxa+RATh3zmKfMkAArzjB2TfYBJEfNntWqQyvePjfynXqsjf8bFipTV/XZawtvQPi0T 07tIbEND7rxAwjS/r/GGKcjKCKRlBqtqiaLoZl1mEAq5GH9nV7prhmoLseSzenezC0IW ViGXEFVWAt0/X6u3Ieht71oDAwMTgvZCEJSBxFzS856m/8xAOy9NSjngULsYI/fLsxLa RFMA== X-Gm-Message-State: APjAAAVK3/OnEf9ZfrXOJEkhu0i0n98LWKkUM9Aj1n/KICAD/YVf9Y/y IrqKlkX8fNEzWzzgkBdQvcSPJb4U1TEcjw== X-Google-Smtp-Source: APXvYqy+AglBLlxnkX6w8FWtTUVkQmE2gRMJVT02rUcbo0NKXFJ5WWm7xt6BnlJFrf63Q9heDHe9Tg== X-Received: by 2002:ac8:32e8:: with SMTP id a37mr63611658qtb.231.1564067939527; Thu, 25 Jul 2019 08:18:59 -0700 (PDT) Date: Thu, 25 Jul 2019 11:18:54 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <20190725151735.29334-1-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email 2.22.0.678.g13338e74b8 X-Mutt-Fcc: =sent X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.85.160.193 Subject: [Qemu-devel] [PATCH v4] virtio-balloon: free pbp more aggressively X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Eduardo Habkost , David Hildenbrand , qemu-stable@nongnu.org, Paolo Bonzini , Igor Mammedov , Richard Henderson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Previous patches switched to a temporary pbp but that does not go far enough: after device uses a buffer, guest is free to reuse it, so tracking the page and freeing it later is wrong. Free and reset the pbp after we push each element. Fixes: ed48c59875b6 ("virtio-balloon: Safely handle BALLOON_PAGE_SIZE < hos= t page size") Cc: qemu-stable@nongnu.org #v4.0.0 Cc: David Hildenbrand Signed-off-by: Michael S. Tsirkin Reviewed-by: David Hildenbrand --- changes from v2, v3: v3 was same as v2, sent by mistake v4 fixes a typo hw/virtio/virtio-balloon.c | 37 ++++++++++++++++--------------------- diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index fe9664e42c..25de154307 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -41,22 +41,19 @@ typedef struct PartiallyBalloonedPage { =20 static void virtio_balloon_pbp_free(PartiallyBalloonedPage *pbp) { - if (!pbp) { + if (!pbp->bitmap) { return; } g_free(pbp->bitmap); - g_free(pbp); + pbp->bitmap =3D NULL; } =20 -static PartiallyBalloonedPage *virtio_balloon_pbp_alloc(ram_addr_t base_gp= a, - long subpages) +static void virtio_balloon_pbp_alloc(PartiallyBalloonedPage *pbp, + ram_addr_t base_gpa, + long subpages) { - PartiallyBalloonedPage *pbp =3D g_new0(PartiallyBalloonedPage, 1); - pbp->base_gpa =3D base_gpa; pbp->bitmap =3D bitmap_new(subpages); - - return pbp; } =20 static bool virtio_balloon_pbp_matches(PartiallyBalloonedPage *pbp, @@ -67,7 +64,7 @@ static bool virtio_balloon_pbp_matches(PartiallyBallooned= Page *pbp, =20 static void balloon_inflate_page(VirtIOBalloon *balloon, MemoryRegion *mr, hwaddr mr_offset, - PartiallyBalloonedPage **pbp) + PartiallyBalloonedPage *pbp) { void *addr =3D memory_region_get_ram_ptr(mr) + mr_offset; ram_addr_t rb_offset, rb_aligned_offset, base_gpa; @@ -104,22 +101,21 @@ static void balloon_inflate_page(VirtIOBalloon *ballo= on, base_gpa =3D memory_region_get_ram_addr(mr) + mr_offset - (rb_offset - rb_aligned_offset); =20 - if (*pbp && !virtio_balloon_pbp_matches(*pbp, base_gpa)) { + if (pbp->bitmap && !virtio_balloon_pbp_matches(pbp, base_gpa)) { /* We've partially ballooned part of a host page, but now * we're trying to balloon part of a different one. Too hard, * give up on the old partial page */ - virtio_balloon_pbp_free(*pbp); - *pbp =3D NULL; + virtio_balloon_pbp_free(pbp); } =20 - if (!*pbp) { - *pbp =3D virtio_balloon_pbp_alloc(base_gpa, subpages); + if (!pbp->bitmap) { + virtio_balloon_pbp_alloc(pbp, base_gpa, subpages); } =20 set_bit((rb_offset - rb_aligned_offset) / BALLOON_PAGE_SIZE, - (*pbp)->bitmap); + pbp->bitmap); =20 - if (bitmap_full((*pbp)->bitmap, subpages)) { + if (bitmap_full(pbp->bitmap, subpages)) { /* We've accumulated a full host page, we can actually discard * it now */ =20 @@ -127,8 +123,7 @@ static void balloon_inflate_page(VirtIOBalloon *balloon, /* We ignore errors from ram_block_discard_range(), because it * has already reported them, and failing to discard a balloon * page is not fatal */ - virtio_balloon_pbp_free(*pbp); - *pbp =3D NULL; + virtio_balloon_pbp_free(pbp); } } =20 @@ -328,13 +323,14 @@ static void balloon_stats_set_poll_interval(Object *o= bj, Visitor *v, static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq) { VirtIOBalloon *s =3D VIRTIO_BALLOON(vdev); - PartiallyBalloonedPage *pbp =3D NULL; VirtQueueElement *elem; MemoryRegionSection section; =20 for (;;) { + PartiallyBalloonedPage pbp =3D {}; size_t offset =3D 0; uint32_t pfn; + elem =3D virtqueue_pop(vq, sizeof(VirtQueueElement)); if (!elem) { break; @@ -379,9 +375,8 @@ static void virtio_balloon_handle_output(VirtIODevice *= vdev, VirtQueue *vq) virtqueue_push(vq, elem, offset); virtio_notify(vdev, vq); g_free(elem); + virtio_balloon_pbp_free(&pbp); } - - virtio_balloon_pbp_free(pbp); } =20 static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq) --=20 MST