Commit 4ba5a8a7 authored Oct 14, 2025 by David Hildenbrand Committed by Andrew Morton Oct 21, 2025

vmw_balloon: indicate success when effectively deflating during migration

When migrating a balloon page, we first deflate the old page to then
inflate the new page.

However, if inflating the new page succeeded, we effectively deflated the
old page, reducing the balloon size.

In that case, the migration actually worked: similar to migrating+
immediately deflating the new page.  The old page will be freed back to
the buddy.

Right now, the core will leave the page be marked as isolated (as we
returned an error).  When later trying to putback that page, we will run
into the WARN_ON_ONCE() in balloon_page_putback().

That handling was changed in commit 3544c4fa ("mm/balloon_compaction:
stop using __ClearPageMovable()"); before that change, we would have
tolerated that way of handling it.

To fix it, let's just return 0 in that case, making the core effectively
just clear the "isolated" flag + freeing it back to the buddy as if the
migration succeeded.  Note that the new page will also get freed when the
core puts the last reference.

Note that this also makes it all be more consistent: we will no longer
unisolate the page in the balloon driver while keeping it marked as being
isolated in migration core.

This was found by code inspection.

Link: https://lkml.kernel.org/r/20251014124455.478345-1-david@redhat.com


Fixes: 3544c4fa ("mm/balloon_compaction: stop using __ClearPageMovable()")
Signed-off-by: David Hildenbrand <david@redhat.com>
Cc: Jerrin Shaji George <jerrin.shaji-george@broadcom.com>
Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

parent c3fa5b1b

drivers/misc/vmw_balloon.c

+3 −5

Original line number	Diff line number	Diff line
		@@ -1737,7 +1737,7 @@ static int vmballoon_migratepage(struct balloon_dev_info *b_dev_info,
		{
		unsigned long status, flags;
		struct vmballoon *b;
		int ret;
		int ret = 0;

		b = container_of(b_dev_info, struct vmballoon, b_dev_info);

		@@ -1796,17 +1796,15 @@ static int vmballoon_migratepage(struct balloon_dev_info *b_dev_info,
		* A failure happened. While we can deflate the page we just
		* inflated, this deflation can also encounter an error. Instead
		* we will decrease the size of the balloon to reflect the
		* change and report failure.
		* change.
		*/
		atomic64_dec(&b->size);
		ret = -EBUSY;
		} else {
		/*
		* Success. Take a reference for the page, and we will add it to
		* the list after acquiring the lock.
		*/
		get_page(newpage);
		ret = 0;
		}

		/* Update the balloon list under the @pages_lock */
		@@ -1817,7 +1815,7 @@ static int vmballoon_migratepage(struct balloon_dev_info *b_dev_info,
		* If we succeed just insert it to the list and update the statistics
		* under the lock.
		*/
		if (!ret) {
		if (status == VMW_BALLOON_SUCCESS) {
		balloon_page_insert(&b->b_dev_info, newpage);
		__count_vm_event(BALLOON_MIGRATE);
		}