From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 22 Jul 2019 19:02:41 +0000 (+0200)
Subject: 5.2-stable patches
X-Git-Tag: v5.2.3~67
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=049a81f9671c891a8806d44aa5d4db7e6afb78cc;p=thirdparty%2Fkernel%2Fstable-queue.git

5.2-stable patches

added patches:
	xen-let-alloc_xenballooned_pages-fail-if-not-enough-memory-free.patch
---

diff --git a/queue-5.2/series b/queue-5.2/series
index 6c3a1910229..8ee0a3b10cb 100644
--- a/queue-5.2/series
+++ b/queue-5.2/series
@@ -249,3 +249,4 @@ floppy-fix-div-by-zero-in-setup_format_params.patch
 floppy-fix-out-of-bounds-read-in-next_valid_format.patch
 floppy-fix-invalid-pointer-dereference-in-drive_name.patch
 floppy-fix-out-of-bounds-read-in-copy_buffer.patch
+xen-let-alloc_xenballooned_pages-fail-if-not-enough-memory-free.patch
diff --git a/queue-5.2/xen-let-alloc_xenballooned_pages-fail-if-not-enough-memory-free.patch b/queue-5.2/xen-let-alloc_xenballooned_pages-fail-if-not-enough-memory-free.patch
new file mode 100644
index 00000000000..a6d65ce2600
--- /dev/null
+++ b/queue-5.2/xen-let-alloc_xenballooned_pages-fail-if-not-enough-memory-free.patch
@@ -0,0 +1,70 @@
+From a1078e821b605813b63bf6bca414a85f804d5c66 Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Wed, 19 Jun 2019 11:00:56 +0200
+Subject: xen: let alloc_xenballooned_pages() fail if not enough memory free
+
+From: Juergen Gross <jgross@suse.com>
+
+commit a1078e821b605813b63bf6bca414a85f804d5c66 upstream.
+
+Instead of trying to allocate pages with GFP_USER in
+add_ballooned_pages() check the available free memory via
+si_mem_available(). GFP_USER is far less limiting memory exhaustion
+than the test via si_mem_available().
+
+This will avoid dom0 running out of memory due to excessive foreign
+page mappings especially on ARM and on x86 in PVH mode, as those don't
+have a pre-ballooned area which can be used for foreign mappings.
+
+As the normal ballooning suffers from the same problem don't balloon
+down more than si_mem_available() pages in one iteration. At the same
+time limit the default maximum number of retries.
+
+This is part of XSA-300.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/balloon.c |   16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -538,8 +538,15 @@ static void balloon_process(struct work_
+ 				state = reserve_additional_memory();
+ 		}
+ 
+-		if (credit < 0)
+-			state = decrease_reservation(-credit, GFP_BALLOON);
++		if (credit < 0) {
++			long n_pages;
++
++			n_pages = min(-credit, si_mem_available());
++			state = decrease_reservation(n_pages, GFP_BALLOON);
++			if (state == BP_DONE && n_pages != -credit &&
++			    n_pages < totalreserve_pages)
++				state = BP_EAGAIN;
++		}
+ 
+ 		state = update_schedule(state);
+ 
+@@ -578,6 +585,9 @@ static int add_ballooned_pages(int nr_pa
+ 		}
+ 	}
+ 
++	if (si_mem_available() < nr_pages)
++		return -ENOMEM;
++
+ 	st = decrease_reservation(nr_pages, GFP_USER);
+ 	if (st != BP_DONE)
+ 		return -ENOMEM;
+@@ -710,7 +720,7 @@ static int __init balloon_init(void)
+ 	balloon_stats.schedule_delay = 1;
+ 	balloon_stats.max_schedule_delay = 32;
+ 	balloon_stats.retry_count = 1;
+-	balloon_stats.max_retry_count = RETRY_UNLIMITED;
++	balloon_stats.max_retry_count = 4;
+ 
+ #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+ 	set_online_page_callback(&xen_online_page);