Xen devel - Nov 2012 - [PATCH] libxl - fix a variable underflow in libxl_wait_for_free_memory

When xl is called to create a domU and there is not enough memory available, 
then the autoballooning is called to extract memory from dom0. During the 
ballooning a loop in libxl_wait_for_free_memory() waits unless enough memory 
is available to create the domU. 

But because of a variable-underflow the loop can finish too soon and xl 
finally aborts with the message:


xc: error: panic: xc_dom_boot.c:161: xc_dom_boot_mem_init: can''t
allocate low
memory for domain: Out of memory                         
libxl: error: libxl_dom.c:430:libxl__build_pv: xc_dom_boot_mem_init failed: 
Device or resource busy                                    
libxl: error: libxl_create.c:901:domcreate_rebuild_done: cannot (re-)build 
domain: -3        


The variable-underflow happens when freemem_slack is larger then 
info.free_pages*4, because the solution of this operation is converted 
implicit to a unsigned int to match the type of memory_kb.

The problem is fixed by a proper casting.


Signed-off-by: Ronny Hegewald <Ronny.Hegewald@online.de>

--- xen-4.3-20121121/tools/libxl/libxl.c.org	2012-11-22 03:34:00.000000000 
+0000
+++ xen-4.3-20121121/tools/libxl/libxl.c	2012-11-22 03:34:47.000000000 +0000
@@ -3763,7 +3763,7 @@ int libxl_wait_for_free_memory(libxl_ctx
         rc = libxl_get_physinfo(ctx, &info);
         if (rc < 0)
             goto out;
-        if (info.free_pages * 4 - freemem_slack >= memory_kb) {
+        if ((int64_t)(info.free_pages * 4 - freemem_slack) >= memory_kb) {
             rc = 0;
             goto out;
         }

On Fri, 2012-11-23 at 00:14 +0000, Ronny Hegewald wrote:
> When xl is called to create a domU and there is not enough memory
available,
> then the autoballooning is called to extract memory from dom0. During the 
> ballooning a loop in libxl_wait_for_free_memory() waits unless enough
memory
> is available to create the domU. 
> 
> But because of a variable-underflow the loop can finish too soon and xl 
> finally aborts with the message:
> 
> 
> xc: error: panic: xc_dom_boot.c:161: xc_dom_boot_mem_init: can''t
allocate low
> memory for domain: Out of memory                         
> libxl: error: libxl_dom.c:430:libxl__build_pv: xc_dom_boot_mem_init failed:
> Device or resource busy                                    
> libxl: error: libxl_create.c:901:domcreate_rebuild_done: cannot (re-)build 
> domain: -3        
> 
> 
> The variable-underflow happens when freemem_slack is larger then 
> info.free_pages*4, because the solution of this operation is converted 
> implicit to a unsigned int to match the type of memory_kb.
> 
> The problem is fixed by a proper casting.
Thanks for your patch.

I think the correct fix is to check for the "freemem_slack >
info.free_pages * 4" case explicitly rather than relying on casts.

Ian.
> 
> 
> Signed-off-by: Ronny Hegewald <Ronny.Hegewald@online.de>
> 
> --- xen-4.3-20121121/tools/libxl/libxl.c.org	2012-11-22 03:34:00.000000000 
> +0000
> +++ xen-4.3-20121121/tools/libxl/libxl.c	2012-11-22 03:34:47.000000000
+0000
> @@ -3763,7 +3763,7 @@ int libxl_wait_for_free_memory(libxl_ctx
>          rc = libxl_get_physinfo(ctx, &info);
>          if (rc < 0)
>              goto out;
> -        if (info.free_pages * 4 - freemem_slack >= memory_kb) {
> +        if ((int64_t)(info.free_pages * 4 - freemem_slack) >=
memory_kb) {
>              rc = 0;
>              goto out;
>          }
> 
> 
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> http://lists.xen.org/xen-devel