[Devel] [PATCH RHEL10 COMMIT] virtio_balloon: warn on failed buffer add to a broken queue

[Konstantin Khorenko]

The commit is pushed to "branch-rh10-6.12.0-211.16.1.12.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git
after rh10-6.12.0-211.16.1.12.7.vz10
------>
commit f531452e7bfce6c21e47919ccf3b0712f351ad27
Author: Denis V. Lunev <den at openvz.org>
Date:   Mon Jun 29 14:34:56 2026 +0200

    virtio_balloon: warn on failed buffer add to a broken queue
    
    tell_host() and stats_handle_request() both ignore the return value of
    virtqueue_add_outbuf() and go on to kick the queue. The comment claims
    "We should always be able to add one buffer to an empty queue", but that
    does not hold once the virtqueue has been broken (e.g. on device
    shutdown), where the add fails with -EIO.
    
    In tell_host() the following wait_event() would then block forever on a
    buffer the host can never return. stats_handle_request() does not
    wait_event() afterwards so it cannot hang, but it still kicks a queue
    with nothing queued.
    
    Warn and bail out on failure in both, mirroring
    virtballoon_free_page_report().
    
    Feature: fix ms/virtio_balloon
    https://virtuozzo.atlassian.net/browse/VSTOR-135654
    Suggested-by: David Hildenbrand <david at kernel.org>
    Signed-off-by: Denis V. Lunev <den at openvz.org>
---
 drivers/virtio/virtio_balloon.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index d6106ccecf71d..56c6525556631 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -185,16 +185,18 @@ static void tell_host(struct virtio_balloon *vb, struct virtqueue *vq)
 {
 	struct scatterlist sg;
 	unsigned int len;
+	int err;
 
 	sg_init_one(&sg, vb->pfns, sizeof(vb->pfns[0]) * vb->num_pfns);
 
 	/* We should always be able to add one buffer to an empty queue. */
-	virtqueue_add_outbuf(vq, &sg, 1, vb, GFP_KERNEL);
+	err = virtqueue_add_outbuf(vq, &sg, 1, vb, GFP_KERNEL);
+	if (WARN_ON_ONCE(err))
+		return;
 	virtqueue_kick(vq);
 
 	/* When host has read buffer, this completes via balloon_ack */
 	wait_event(vb->acked, virtqueue_get_buf(vq, &len));
-
 }
 
 static int virtballoon_free_page_report(struct page_reporting_dev_info *pr_dev_info,
@@ -449,6 +451,7 @@ static void stats_handle_request(struct virtio_balloon *vb)
 	struct virtqueue *vq;
 	struct scatterlist sg;
 	unsigned int len, num_stats;
+	int err;
 
 	num_stats = update_balloon_stats(vb);
 
@@ -456,7 +459,9 @@ static void stats_handle_request(struct virtio_balloon *vb)
 	if (!virtqueue_get_buf(vq, &len))
 		return;
 	sg_init_one(&sg, vb->stats, sizeof(vb->stats[0]) * num_stats);
-	virtqueue_add_outbuf(vq, &sg, 1, vb, GFP_KERNEL);
+	err = virtqueue_add_outbuf(vq, &sg, 1, vb, GFP_KERNEL);
+	if (WARN_ON_ONCE(err))
+		return;
 	virtqueue_kick(vq);
 }