Re: [Qemu-devel] [PATCH] balloon: Fix overflow when reporting actual memory size

[Aurelien Jarno <aurelien@aurel32.net>]

On Thu, Mar 25, 2010 at 08:58:17AM -0500, Adam Litke wrote:
> Beginning with its introduction, the virtio balloon has had an overflow error
> that causes 'info balloon' to misreport the actual memory size when the balloon
> itself becomes larger than 4G.  Use a cast when converting dev->actual from
> pages to kB to prevent overflows.
>
> Before:
> (qemu) info balloon
> balloon: actual=5120
> (qemu) balloon 1025
> (qemu) info balloon
> balloon: actual=1025
> (qemu) balloon 1024
> (qemu) info balloon
> balloon: actual=5120
>
> After:
> (qemu) info balloon
> balloon: actual=5120
> (qemu) balloon 1025
> (qemu) info balloon
> balloon: actual=1025
> (qemu) balloon 1024
> (qemu) info balloon
> balloon: actual=1024

Thanks, applied.

> Signed-off-by: Adam Litke <agl@us.ibm.com>
> ---
> hw/virtio-balloon.c |    3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/hw/virtio-balloon.c b/hw/virtio-balloon.c
> index 086d9d1..6eedab1 100644
> --- a/hw/virtio-balloon.c
> +++ b/hw/virtio-balloon.c
> @@ -78,7 +78,8 @@ static void stat_put(QDict *dict, const char *label, uint64_t val)
> static QObject *get_stats_qobject(VirtIOBalloon *dev)
> {
>     QDict *dict = qdict_new();
> -    uint32_t actual = ram_size - (dev->actual << VIRTIO_BALLOON_PFN_SHIFT);
> +    uint64_t actual = ram_size - ((uint64_t) dev->actual <<
> +                                  VIRTIO_BALLOON_PFN_SHIFT);
>
>     stat_put(dict, "actual", actual);
>     stat_put(dict, "mem_swapped_in", dev->stats[VIRTIO_BALLOON_S_SWAP_IN]);
> -- 
> 1.6.3.3
>
>
>
>
>

-- 
Aurelien Jarno	                        GPG: 1024D/F1BCDB73
aurelien@aurel32.net                 http://www.aurel32.net