Re: [Xen-devel] [PATCH] libxl - fix a variable underflow in libxl_wait_for_free_memory

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

On Fri, 2012-11-23 at 00:14 +0000, Ronny Hegewald wrote:
> When xl is called to create a domU and there is not enough memory available, 
> then the autoballooning is called to extract memory from dom0. During the 
> ballooning a loop in libxl_wait_for_free_memory() waits unless enough memory 
> is available to create the domU. 
> 
> But because of a variable-underflow the loop can finish too soon and xl 
> finally aborts with the message:
> 
> 
> xc: error: panic: xc_dom_boot.c:161: xc_dom_boot_mem_init: can't allocate low 
> memory for domain: Out of memory                         
> libxl: error: libxl_dom.c:430:libxl__build_pv: xc_dom_boot_mem_init failed: 
> Device or resource busy                                    
> libxl: error: libxl_create.c:901:domcreate_rebuild_done: cannot (re-)build 
> domain: -3        
> 
> 
> The variable-underflow happens when freemem_slack is larger then 
> info.free_pages*4, because the solution of this operation is converted 
> implicit to a unsigned int to match the type of memory_kb.
> 
> The problem is fixed by a proper casting.

Thanks for your patch.

I think the correct fix is to check for the "freemem_slack >
info.free_pages * 4" case explicitly rather than relying on casts.

Ian.

> 
> 
> Signed-off-by: Ronny Hegewald <Ronny.Hegewald@xxxxxxxxx>
> 
> --- xen-4.3-20121121/tools/libxl/libxl.c.org  2012-11-22 03:34:00.000000000 
> +0000
> +++ xen-4.3-20121121/tools/libxl/libxl.c      2012-11-22 03:34:47.000000000 
> +0000
> @@ -3763,7 +3763,7 @@ int libxl_wait_for_free_memory(libxl_ctx
>          rc = libxl_get_physinfo(ctx, &info);
>          if (rc < 0)
>              goto out;
> -        if (info.free_pages * 4 - freemem_slack >= memory_kb) {
> +        if ((int64_t)(info.free_pages * 4 - freemem_slack) >= memory_kb) {
>              rc = 0;
>              goto out;
>          }
> 
> 
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxx
> http://lists.xen.org/xen-devel



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel