From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ian Campbell <Ian.Campbell@citrix.com>
Subject: Re: [PATCH v3] libxl_set_memory_target: retain the same
 maxmem offset on top of the current target
Date: Mon, 2 Feb 2015 14:31:42 +0000
Message-ID: <1422887502.19293.31.camel@citrix.com>
References: <1422544138-28917-1-git-send-email-stefano.stabellini@eu.citrix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <1422544138-28917-1-git-send-email-stefano.stabellini@eu.citrix.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: Ian.Jackson@eu.citrix.com, xen-devel@lists.xensource.com, wei.liu2@citrix.com, dslutz@verizon.com
List-Id: xen-devel@lists.xenproject.org

On Thu, 2015-01-29 at 15:08 +0000, Stefano Stabellini wrote:
> @@ -4775,6 +4781,14 @@ retry_transaction:
>              new_target_memkb = current_target_memkb + target_memkb;
>      } else
>          new_target_memkb = target_memkb - videoram;
> +
> +    if (new_target_memkb <= 0) {
> +        LIBXL__LOG(ctx, LIBXL__LOG_ERROR,
> +                "cannot set memory target to 0 or less than 0.\n");


new_target_memkb is uint32 so it can't be less than zero.

In fact, there looks to be some under/overflow bugs hidden in this
function. e.g. in "new_target_memkb = target_memkb" (since target is
signed)

Ian.