xen/balloon: Fix crash when ballooning on x86 32 bit PAE (dfd74a1e) · Commits · 戴 / test

Commit (xen/balloon: find non-conflicting regions to place hotplugged memory) caused a regression in 4.4. When ballooning on an x86 32 bit PAE system with close to 64 GiB of memory, the address returned by allocate_resource may be above 64 GiB. When using CONFIG_SPARSEMEM, this setup is limited to using physical addresses < 64 GiB. When adding memory at this address, it runs off the end of the mem_section array and causes a crash. Instead, fail the ballooning request. Signed-off-by:

Ross Lagerwall <ross.lagerwall@citrix.com> Cc: <stable@vger.kernel.org> # 4.4+ Signed-off-by:

David Vrabel <david.vrabel@citrix.com>

drivers/xen/balloon.c

+16 −0

Original line number	Diff line number	Diff line
		@@ -151,6 +151,8 @@ static DECLARE_WAIT_QUEUE_HEAD(balloon_wq);
		static void balloon_process(struct work_struct *work);
		static DECLARE_DELAYED_WORK(balloon_worker, balloon_process);

		static void release_memory_resource(struct resource *resource);

		/* When ballooning out (allocating memory to return to Xen) we don't really
		want the kernel to try too hard since that can trigger the oom killer. */
		#define GFP_BALLOON \
		@@ -267,6 +269,20 @@ static struct resource *additional_memory_resource(phys_addr_t size)
		return NULL;
		}

		#ifdef CONFIG_SPARSEMEM
		{
		unsigned long limit = 1UL << (MAX_PHYSMEM_BITS - PAGE_SHIFT);
		unsigned long pfn = res->start >> PAGE_SHIFT;

		if (pfn > limit) {
		pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",
		pfn, limit);
		release_memory_resource(res);
		return NULL;
		}
		}
		#endif

		return res;
		}

Admin message