Re: [Xen-devel] [PATCH V2] libxl: fix a variable underflow in libxl_wait_for_free_memory

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

On Mon, 2012-11-26 at 23:53 +0000, Ronny Hegewald wrote:
> When xl is called to create a domU and there is not enough memory available, 
> then the autoballooning is called to extract memory from dom0. During the 
> ballooning a loop in libxl_wait_for_free_memory() waits unless enough memory 
> is available to create the domU. 
> 
> But because of a variable-underflow the loop can finish too soon and xl 
> finally aborts with the message:
> 
> 
> xc: error: panic: xc_dom_boot.c:161: xc_dom_boot_mem_init: can't allocate low 
> memory for domain: Out of memory                         
> libxl: error: libxl_dom.c:430:libxl__build_pv: xc_dom_boot_mem_init failed: 
> Device or resource busy                                    
> libxl: error: libxl_create.c:901:domcreate_rebuild_done: cannot (re-)build 
> domain: -3        
> 
> 
> The variable-underflow happens when freemem_slack is larger then 
> info.free_pages*4, because the solution of this operation is converted 
> implicit to a unsigned int to match the type of memory_kb.
> 
> Add a extra check for this condition to solve the problem.
> 
> ---
> 
> Changes since V1:
>   * check for valid ranges of freemem_slack instead of casting around values, 
>     as suggested by Ian Campbell   
> 
> 
> Signed-off-by: Ronny Hegewald <Ronny.Hegewald@xxxxxxxxx>

(moved this above the "---" so it got included in the commit message).

Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>

There was some minor whitespace damage but for once it was trival  to
fix up so I have applied it, thanks.

Ian J -- this is a stable branch candidate IMHO.

> --- xen-4.3-20121121/tools/libxl/libxl.c.org  2012-11-22 03:34:00.000000000 
> +0000
> +++ xen-4.3-20121121/tools/libxl/libxl.c      2012-11-26 21:29:42.000000000 
> +0000
> @@ -3763,7 +3763,8 @@ int libxl_wait_for_free_memory(libxl_ctx
>          rc = libxl_get_physinfo(ctx, &info);
>          if (rc < 0)
>              goto out;
> -        if (info.free_pages * 4 - freemem_slack >= memory_kb) {
> +        if (info.free_pages * 4 >= freemem_slack && 
> +            info.free_pages * 4 - freemem_slack >= memory_kb) {
>              rc = 0;
>              goto out;
>          }
> 
> 
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxx
> http://lists.xen.org/xen-devel




_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel