vmm: handle malformed balloon actual from guest

dgreid · rbradford · commit 65073259c6a9 · 2026-03-26T08:54:54.000Z
The actual size of the balloon is taken directly from the guest. A
misbehaving guest can set it to an arbitrary value and cause underflow
on the next vm.info call. Use a saturation_sub instead to avoid a panic
in a debug build or a crazy number in a release build.

Signed-off-by: Dylan Reid &lt;dgreid@dylanreid.com&gt;
diff --git a/vmm/src/lib.rs b/vmm/src/lib.rs
@@ -2061,7 +2061,7 @@ impl RequestHandler for Vmm {
 
                 let mut memory_actual_size = config.memory.total_size();
                 if let Some(vm) = &self.vm {
-                    memory_actual_size -= vm.balloon_size();
+                    memory_actual_size = memory_actual_size.saturating_sub(vm.balloon_size());
                 }
 
                 let device_tree = self

Original file line number	Diff line number	Diff line change
`@@ -2061,7 +2061,7 @@ impl RequestHandler for Vmm {`
`2061`	`2061`
`2062`	`2062`	`let mut memory_actual_size = config.memory.total_size();`
`2063`	`2063`	`if let Some(vm) = &self.vm {`
`2064`		`- memory_actual_size -= vm.balloon_size();`
	`2064`	`+ memory_actual_size = memory_actual_size.saturating_sub(vm.balloon_size());`
`2065`	`2065`	`}`
`2066`	`2066`
`2067`	`2067`	`let device_tree = self`