From patchwork Tue May 10 21:05:13 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 775372 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter2.kernel.org (8.14.4/8.14.3) with ESMTP id p4AL5blv000975 for ; Tue, 10 May 2011 21:05:38 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751450Ab1EJVFe (ORCPT ); Tue, 10 May 2011 17:05:34 -0400 Received: from mail-ww0-f44.google.com ([74.125.82.44]:62622 "EHLO mail-ww0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751130Ab1EJVFd (ORCPT ); Tue, 10 May 2011 17:05:33 -0400 Received: by wwa36 with SMTP id 36so7321676wwa.1 for ; Tue, 10 May 2011 14:05:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:from:to:cc:subject:date:message-id:x-mailer :in-reply-to:references; bh=AFQ4EualhMNhsta9ZSkBD3xk2dKxsz1HvcUVAUrWobk=; b=M6UJy0h9AnQkzWr5zyTNfuoU08i/Vqd/1YKv2G+RuC+e1AAoI07GppLHNdd9Rx/soI 2PxDXvg5JSSrTrTw71V2S2ItPBXMkAeeFce4ksh4PXvk+2AwEMZdO5Rqp3dXqRO4SU3g ioDu0R3edo/u9eqp2X+urMQ0E/nYdoPi9yYYA= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; b=Q2c+1RvHWHxLabhxsOWxNCpGL1yk8Xl28gmpAUNVXaB1laQlaSHKZeNszhjTeIvhPR Yd8uylm4uCleOrFmlbLCZNQ2KEo1kWQtSzBynRoCLvcwU+zjLT6GouKbL2A1gkF20qlO m+1IFSnjyt3cekdAGom0gfEiIQIYl/Ey2idlg= Received: by 10.216.65.203 with SMTP id f53mr4831201wed.54.1305061532309; Tue, 10 May 2011 14:05:32 -0700 (PDT) Received: from localhost.localdomain ([188.120.134.217]) by mx.google.com with ESMTPS id m14sm2341809wes.14.2011.05.10.14.05.30 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 10 May 2011 14:05:31 -0700 (PDT) From: Sasha Levin To: penberg@kernel.org Cc: mingo@elte.hu, asias.hejun@gmail.com, prasadjoshi124@gmail.com, avi@redhat.com, gorcunov@gmail.com, kvm@vger.kernel.org, Sasha Levin Subject: [PATCH 2/2] kvm tools: Prevent PFN wraparound Date: Wed, 11 May 2011 00:05:13 +0300 Message-Id: <1305061513-28360-2-git-send-email-levinsasha928@gmail.com> X-Mailer: git-send-email 1.7.5.rc3 In-Reply-To: <1305061513-28360-1-git-send-email-levinsasha928@gmail.com> References: <1305061513-28360-1-git-send-email-levinsasha928@gmail.com> Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter2.kernel.org [140.211.167.43]); Tue, 10 May 2011 21:05:38 +0000 (UTC) queue->pfn may be used to point at addresses larger than 32 bit. Prevent a wraparound when shifting it left. Signed-off-by: Sasha Levin --- tools/kvm/virtio/blk.c | 2 +- tools/kvm/virtio/console.c | 2 +- tools/kvm/virtio/net.c | 2 +- tools/kvm/virtio/rng.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/kvm/virtio/blk.c b/tools/kvm/virtio/blk.c index 12c7029..b7fea79 100644 --- a/tools/kvm/virtio/blk.c +++ b/tools/kvm/virtio/blk.c @@ -197,7 +197,7 @@ static bool virtio_blk_pci_io_out(struct kvm *self, u16 port, void *data, int si queue = &bdev->vqs[bdev->queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_flat_to_host(self, (u64)queue->pfn << 12); vring_init(&queue->vring, VIRTIO_BLK_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/console.c b/tools/kvm/virtio/console.c index f9031cb..7a5bc89 100644 --- a/tools/kvm/virtio/console.c +++ b/tools/kvm/virtio/console.c @@ -199,7 +199,7 @@ static bool virtio_console_pci_io_out(struct kvm *self, u16 port, void *data, in queue = &cdev.vqs[cdev.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_flat_to_host(self, (u64)queue->pfn << 12); vring_init(&queue->vring, VIRTIO_CONSOLE_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/net.c b/tools/kvm/virtio/net.c index 8d430e3..13caba2 100644 --- a/tools/kvm/virtio/net.c +++ b/tools/kvm/virtio/net.c @@ -245,7 +245,7 @@ static bool virtio_net_pci_io_out(struct kvm *self, u16 port, void *data, int si queue = &net_device.vqs[net_device.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_flat_to_host(self, (u64)queue->pfn << 12); vring_init(&queue->vring, VIRTIO_NET_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/rng.c b/tools/kvm/virtio/rng.c index f692dfd..60baa8e 100644 --- a/tools/kvm/virtio/rng.c +++ b/tools/kvm/virtio/rng.c @@ -129,7 +129,7 @@ static bool virtio_rng_pci_io_out(struct kvm *kvm, u16 port, void *data, int siz queue = &rdev.vqs[rdev.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(kvm, queue->pfn << 12); + p = guest_flat_to_host(kvm, (u64)queue->pfn << 12); vring_init(&queue->vring, VIRTIO_RNG_QUEUE_SIZE, p, 4096);