Commit dfd74a1e authored by Ross Lagerwall's avatar Ross Lagerwall Committed by David Vrabel

xen/balloon: Fix crash when ballooning on x86 32 bit PAE

Commit 55b3da98 (xen/balloon: find
non-conflicting regions to place hotplugged memory) caused a
regression in 4.4.

When ballooning on an x86 32 bit PAE system with close to 64 GiB of
memory, the address returned by allocate_resource may be above 64 GiB.
When using CONFIG_SPARSEMEM, this setup is limited to using physical
addresses < 64 GiB.  When adding memory at this address, it runs off
the end of the mem_section array and causes a crash.  Instead, fail
the ballooning request.
Signed-off-by: default avatarRoss Lagerwall <ross.lagerwall@citrix.com>
Cc: <stable@vger.kernel.org> # 4.4+
Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
parent 60901df3
...@@ -151,6 +151,8 @@ static DECLARE_WAIT_QUEUE_HEAD(balloon_wq); ...@@ -151,6 +151,8 @@ static DECLARE_WAIT_QUEUE_HEAD(balloon_wq);
static void balloon_process(struct work_struct *work); static void balloon_process(struct work_struct *work);
static DECLARE_DELAYED_WORK(balloon_worker, balloon_process); static DECLARE_DELAYED_WORK(balloon_worker, balloon_process);
static void release_memory_resource(struct resource *resource);
/* When ballooning out (allocating memory to return to Xen) we don't really /* When ballooning out (allocating memory to return to Xen) we don't really
want the kernel to try too hard since that can trigger the oom killer. */ want the kernel to try too hard since that can trigger the oom killer. */
#define GFP_BALLOON \ #define GFP_BALLOON \
...@@ -267,6 +269,20 @@ static struct resource *additional_memory_resource(phys_addr_t size) ...@@ -267,6 +269,20 @@ static struct resource *additional_memory_resource(phys_addr_t size)
return NULL; return NULL;
} }
#ifdef CONFIG_SPARSEMEM
{
unsigned long limit = 1UL << (MAX_PHYSMEM_BITS - PAGE_SHIFT);
unsigned long pfn = res->start >> PAGE_SHIFT;
if (pfn > limit) {
pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",
pfn, limit);
release_memory_resource(res);
return NULL;
}
}
#endif
return res; return res;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment