Ronny Hegewald
2012-Nov-26 23:53 UTC
[PATCH V2] libxl: fix a variable underflow in libxl_wait_for_free_memory
When xl is called to create a domU and there is not enough memory available,
then the autoballooning is called to extract memory from dom0. During the
ballooning a loop in libxl_wait_for_free_memory() waits unless enough memory
is available to create the domU.
But because of a variable-underflow the loop can finish too soon and xl
finally aborts with the message:
xc: error: panic: xc_dom_boot.c:161: xc_dom_boot_mem_init: can''t
allocate low
memory for domain: Out of memory
libxl: error: libxl_dom.c:430:libxl__build_pv: xc_dom_boot_mem_init failed:
Device or resource busy
libxl: error: libxl_create.c:901:domcreate_rebuild_done: cannot (re-)build
domain: -3
The variable-underflow happens when freemem_slack is larger then
info.free_pages*4, because the solution of this operation is converted
implicit to a unsigned int to match the type of memory_kb.
Add a extra check for this condition to solve the problem.
---
Changes since V1:
* check for valid ranges of freemem_slack instead of casting around values,
as suggested by Ian Campbell
Signed-off-by: Ronny Hegewald <Ronny.Hegewald@online.de>
--- xen-4.3-20121121/tools/libxl/libxl.c.org 2012-11-22 03:34:00.000000000
+0000
+++ xen-4.3-20121121/tools/libxl/libxl.c 2012-11-26 21:29:42.000000000 +0000
@@ -3763,7 +3763,8 @@ int libxl_wait_for_free_memory(libxl_ctx
rc = libxl_get_physinfo(ctx, &info);
if (rc < 0)
goto out;
- if (info.free_pages * 4 - freemem_slack >= memory_kb) {
+ if (info.free_pages * 4 >= freemem_slack &&
+ info.free_pages * 4 - freemem_slack >= memory_kb) {
rc = 0;
goto out;
}
Ian Campbell
2012-Nov-27 14:14 UTC
Re: [PATCH V2] libxl: fix a variable underflow in libxl_wait_for_free_memory
On Mon, 2012-11-26 at 23:53 +0000, Ronny Hegewald wrote:> When xl is called to create a domU and there is not enough memory available, > then the autoballooning is called to extract memory from dom0. During the > ballooning a loop in libxl_wait_for_free_memory() waits unless enough memory > is available to create the domU. > > But because of a variable-underflow the loop can finish too soon and xl > finally aborts with the message: > > > xc: error: panic: xc_dom_boot.c:161: xc_dom_boot_mem_init: can''t allocate low > memory for domain: Out of memory > libxl: error: libxl_dom.c:430:libxl__build_pv: xc_dom_boot_mem_init failed: > Device or resource busy > libxl: error: libxl_create.c:901:domcreate_rebuild_done: cannot (re-)build > domain: -3 > > > The variable-underflow happens when freemem_slack is larger then > info.free_pages*4, because the solution of this operation is converted > implicit to a unsigned int to match the type of memory_kb. > > Add a extra check for this condition to solve the problem. > > --- > > Changes since V1: > * check for valid ranges of freemem_slack instead of casting around values, > as suggested by Ian Campbell > > > Signed-off-by: Ronny Hegewald <Ronny.Hegewald@online.de>(moved this above the "---" so it got included in the commit message). Acked-by: Ian Campbell <ian.campbell@citrix.com> There was some minor whitespace damage but for once it was trival to fix up so I have applied it, thanks. Ian J -- this is a stable branch candidate IMHO.> --- xen-4.3-20121121/tools/libxl/libxl.c.org 2012-11-22 03:34:00.000000000 > +0000 > +++ xen-4.3-20121121/tools/libxl/libxl.c 2012-11-26 21:29:42.000000000 +0000 > @@ -3763,7 +3763,8 @@ int libxl_wait_for_free_memory(libxl_ctx > rc = libxl_get_physinfo(ctx, &info); > if (rc < 0) > goto out; > - if (info.free_pages * 4 - freemem_slack >= memory_kb) { > + if (info.free_pages * 4 >= freemem_slack && > + info.free_pages * 4 - freemem_slack >= memory_kb) { > rc = 0; > goto out; > } > > > > > _______________________________________________ > Xen-devel mailing list > Xen-devel@lists.xen.org > http://lists.xen.org/xen-devel
Ian Jackson
2012-Nov-29 17:00 UTC
Re: [PATCH V2] libxl: fix a variable underflow in libxl_wait_for_free_memory
Ian Campbell writes ("Re: [Xen-devel] [PATCH V2] libxl: fix a variable
underflow in libxl_wait_for_free_memory"):> On Mon, 2012-11-26 at 23:53 +0000, Ronny Hegewald wrote:
> > When xl is called to create a domU and there is not enough memory
available,
> > then the autoballooning is called to extract memory from dom0. During
the
> > ballooning a loop in libxl_wait_for_free_memory() waits unless enough
memory
...> Ian J -- this is a stable branch candidate IMHO.
I agree, done.
Ian.