Patchwork balloon: Fix overflow when reporting actual memory size

login
register
mail settings
Submitter Adam Litke
Date March 25, 2010, 1:58 p.m.
Message ID <4BAB6BF9.30701@us.ibm.com>
Download mbox | patch
Permalink /patch/48519/
State New
Headers show

Comments

Adam Litke - March 25, 2010, 1:58 p.m.
Beginning with its introduction, the virtio balloon has had an overflow error
that causes 'info balloon' to misreport the actual memory size when the balloon
itself becomes larger than 4G.  Use a cast when converting dev->actual from
pages to kB to prevent overflows.

Before:
(qemu) info balloon
balloon: actual=5120
(qemu) balloon 1025
(qemu) info balloon
balloon: actual=1025
(qemu) balloon 1024
(qemu) info balloon
balloon: actual=5120

After:
(qemu) info balloon
balloon: actual=5120
(qemu) balloon 1025
(qemu) info balloon
balloon: actual=1025
(qemu) balloon 1024
(qemu) info balloon
balloon: actual=1024

Signed-off-by: Adam Litke <agl@us.ibm.com>
---
 hw/virtio-balloon.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
Aurelien Jarno - March 27, 2010, 12:54 p.m.
On Thu, Mar 25, 2010 at 08:58:17AM -0500, Adam Litke wrote:
> Beginning with its introduction, the virtio balloon has had an overflow error
> that causes 'info balloon' to misreport the actual memory size when the balloon
> itself becomes larger than 4G.  Use a cast when converting dev->actual from
> pages to kB to prevent overflows.
>
> Before:
> (qemu) info balloon
> balloon: actual=5120
> (qemu) balloon 1025
> (qemu) info balloon
> balloon: actual=1025
> (qemu) balloon 1024
> (qemu) info balloon
> balloon: actual=5120
>
> After:
> (qemu) info balloon
> balloon: actual=5120
> (qemu) balloon 1025
> (qemu) info balloon
> balloon: actual=1025
> (qemu) balloon 1024
> (qemu) info balloon
> balloon: actual=1024

Thanks, applied.

> Signed-off-by: Adam Litke <agl@us.ibm.com>
> ---
> hw/virtio-balloon.c |    3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/hw/virtio-balloon.c b/hw/virtio-balloon.c
> index 086d9d1..6eedab1 100644
> --- a/hw/virtio-balloon.c
> +++ b/hw/virtio-balloon.c
> @@ -78,7 +78,8 @@ static void stat_put(QDict *dict, const char *label, uint64_t val)
> static QObject *get_stats_qobject(VirtIOBalloon *dev)
> {
>     QDict *dict = qdict_new();
> -    uint32_t actual = ram_size - (dev->actual << VIRTIO_BALLOON_PFN_SHIFT);
> +    uint64_t actual = ram_size - ((uint64_t) dev->actual <<
> +                                  VIRTIO_BALLOON_PFN_SHIFT);
>
>     stat_put(dict, "actual", actual);
>     stat_put(dict, "mem_swapped_in", dev->stats[VIRTIO_BALLOON_S_SWAP_IN]);
> -- 
> 1.6.3.3
>
>
>
>
>

Patch

diff --git a/hw/virtio-balloon.c b/hw/virtio-balloon.c
index 086d9d1..6eedab1 100644
--- a/hw/virtio-balloon.c
+++ b/hw/virtio-balloon.c
@@ -78,7 +78,8 @@  static void stat_put(QDict *dict, const char *label, uint64_t val)
 static QObject *get_stats_qobject(VirtIOBalloon *dev)
 {
     QDict *dict = qdict_new();
-    uint32_t actual = ram_size - (dev->actual << VIRTIO_BALLOON_PFN_SHIFT);
+    uint64_t actual = ram_size - ((uint64_t) dev->actual <<
+                                  VIRTIO_BALLOON_PFN_SHIFT);
 
     stat_put(dict, "actual", actual);
     stat_put(dict, "mem_swapped_in", dev->stats[VIRTIO_BALLOON_S_SWAP_IN]);