1 files changed, 2 insertions, 0 deletions

diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 888d5f8322ce..4e7003db12c4 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -207,6 +207,8 @@ static unsigned leak_balloon(struct virtio_balloon *vb, size_t num)
         num = min(num, ARRAY_SIZE(vb->pfns));
 
         mutex_lock(&vb->balloon_lock);
+        /* We can't release more pages than taken */
+        num = min(num, (size_t)vb->num_pages);
         for (vb->num_pfns = 0; vb->num_pfns < num;
              vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) {
                 page = balloon_page_dequeue(vb_dev_info);