Skip to content

fix(vmm): enforce configured ID pool bounds - #907

Merged
kvinwang merged 4 commits into
masterfrom
codex/fix-vmm-id-pool-bounds
Aug 4, 2026
Merged

fix(vmm): enforce configured ID pool bounds#907
kvinwang merged 4 commits into
masterfrom
codex/fix-vmm-id-pool-bounds

Conversation

@kvinwang

@kvinwang kvinwang commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

Problem

ID allocation did not consistently enforce configured lower and upper pool bounds, including restored state. Exhaustion or stale state could allocate an ID reserved outside the pool.

Root cause and fix

Validate candidates and restored IDs against the configured interval and return exhaustion/error instead of escaping it.

Implementation

The branch records the following focused implementation work:

  • fix(vmm): enforce configured ID pool bounds
  • test(vmm): cover ID pool concurrency and reconstruction

Changed paths:

  • dstack/vmm/src/app/id_pool.rs

Scope

This PR addresses one logical vmm finding. It intentionally excludes the acceptance-test infrastructure from #841 and unrelated product fixes from #840.

Dependency and merge order

This PR is based directly on master and does not require another split product PR to merge first.

Verification

  • git diff --check origin/master..origin/codex/fix-vmm-id-pool-bounds: passed.
  • The declared base was verified as an ancestor of the PR head.
  • Focused compile/check verification was run for the changed component where applicable; non-Rust packaging or configuration changes were reviewed against their exact branch delta.

Copilot AI review requested due to automatic review settings July 31, 2026 03:05

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

reload_vms() and reload_vms_sync() occupy CIDs scraped from processes that
are already running, not ids the pool handed out. Their values come from
whatever cid_start/cid_pool_size was in effect when those VMs launched, so
a bounds error there must not propagate: main.rs treats a reload_vms()
failure as fatal, which would leave every running CVM unmanaged after an
operator (or dstackup's pick_cid_start) moved the pool window.

Report the untracked CID and continue instead.
"id outside pool range" is what an operator reads when the VMM refuses a
CID, and it identifies neither the offending id nor the configured window.
Add Display to the Number bound and interpolate both, and document the
half-open [start, end) contract on IdPool.

Also retarget the tests at what they claim to cover: the "concurrent"
case only serialized 8 threads behind a Mutex, so it exercised the same
path as a sequential loop, and the "maximum boundary" case built an
empty pool (start == end) that returned on the range check without ever
reaching next(). Split them into the allocation, reconstruction,
exhaustion, empty-range and error-message cases, and apply cargo fmt.
@kvinwang
kvinwang enabled auto-merge August 4, 2026 14:12
@kvinwang
kvinwang merged commit 9c20425 into master Aug 4, 2026
15 checks passed
@kvinwang
kvinwang deleted the codex/fix-vmm-id-pool-bounds branch August 7, 2026 13:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants