From 65073259c6a9567f8f40475da00e093aff61498c Mon Sep 17 00:00:00 2001 From: Dylan Reid Date: Wed, 25 Mar 2026 18:08:21 -0700 Subject: [PATCH] vmm: handle malformed balloon actual from guest The actual size of the balloon is taken directly from the guest. A misbehaving guest can set it to an arbitrary value and cause underflow on the next vm.info call. Use a saturation_sub instead to avoid a panic in a debug build or a crazy number in a release build. Signed-off-by: Dylan Reid --- vmm/src/lib.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vmm/src/lib.rs b/vmm/src/lib.rs index d1cf6693a..03edec26b 100644 --- a/vmm/src/lib.rs +++ b/vmm/src/lib.rs @@ -2061,7 +2061,7 @@ impl RequestHandler for Vmm { let mut memory_actual_size = config.memory.total_size(); if let Some(vm) = &self.vm { - memory_actual_size -= vm.balloon_size(); + memory_actual_size = memory_actual_size.saturating_sub(vm.balloon_size()); } let device_tree = self