From patchwork Wed May 11 04:09:10 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 777692 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter2.kernel.org (8.14.4/8.14.3) with ESMTP id p4BHflVI004331 for ; Wed, 11 May 2011 17:41:47 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752505Ab1EKRlo (ORCPT ); Wed, 11 May 2011 13:41:44 -0400 Received: from mail-ww0-f44.google.com ([74.125.82.44]:62283 "EHLO mail-ww0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751811Ab1EKRln (ORCPT ); Wed, 11 May 2011 13:41:43 -0400 Received: by wwa36 with SMTP id 36so869549wwa.1 for ; Wed, 11 May 2011 10:41:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:from:to:cc:subject:date:message-id:x-mailer :in-reply-to:references; bh=AXkfKg+f+GloVglvQcuHYMYItAHRePgzWdPHeWI+onI=; b=FJeaZCqQujZuZn/PJE8YBeVo6dYJhVG5mC3LV6Dfu7fyOmsS5yl0QInr/wt4g3Eh3V bRf+OC2l7todEDKbWN8eTbRUDYiS9BOdgXRpQMM8yUkHrovRRgJKmBad1d8BKrazRqGv fTReV8PuagZYT1goMWbCJHKbkHqdKkvQwe8w8= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; b=IqQtH7JGQTFINzlnPMHcr2aCquZBOSmku2Y/pZf/dsEAEyquuu+ga/8blLeD54rmfd VRESGHLZyyZhUFgulMkPp4KLny/OoDYDZCUmdoU56TvvJ8d9hgZILbVGqE0n7SlU+I+/ jX9gNzR4Q35hP4F2aGDCIi5gMuZbGP3RVj38w= Received: by 10.216.85.73 with SMTP id t51mr4683170wee.65.1305086974023; Tue, 10 May 2011 21:09:34 -0700 (PDT) Received: from localhost.localdomain ([188.120.134.217]) by mx.google.com with ESMTPS id d54sm3838919wej.34.2011.05.10.21.09.32 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 10 May 2011 21:09:33 -0700 (PDT) From: Sasha Levin To: penberg@kernel.org Cc: mingo@elte.hu, asias.hejun@gmail.com, prasadjoshi124@gmail.com, avi@redhat.com, gorcunov@gmail.com, kvm@vger.kernel.org, Sasha Levin Subject: [PATCH 2/3 V2] kvm tools: Prevent PFN wraparound Date: Wed, 11 May 2011 07:09:10 +0300 Message-Id: <1305086951-31698-2-git-send-email-levinsasha928@gmail.com> X-Mailer: git-send-email 1.7.5.rc3 In-Reply-To: <1305086951-31698-1-git-send-email-levinsasha928@gmail.com> References: <1305086951-31698-1-git-send-email-levinsasha928@gmail.com> Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter2.kernel.org [140.211.167.43]); Wed, 11 May 2011 17:41:48 +0000 (UTC) queue->pfn may be used to point at addresses larger than 32 bit. Prevent a wraparound when shifting it left. Signed-off-by: Sasha Levin --- tools/kvm/include/kvm/virtio.h | 5 +++++ tools/kvm/virtio/blk.c | 2 +- tools/kvm/virtio/console.c | 2 +- tools/kvm/virtio/net.c | 2 +- tools/kvm/virtio/rng.c | 2 +- 5 files changed, 9 insertions(+), 4 deletions(-) diff --git a/tools/kvm/include/kvm/virtio.h b/tools/kvm/include/kvm/virtio.h index 7f92dea..beb234a 100644 --- a/tools/kvm/include/kvm/virtio.h +++ b/tools/kvm/include/kvm/virtio.h @@ -36,6 +36,11 @@ static inline bool virt_queue__available(struct virt_queue *vq) return vq->vring.avail->idx != vq->last_avail_idx; } +static inline void *guest_pfn_to_host(struct kvm *kvm, u32 pfn) +{ + return guest_flat_to_host(kvm, (unsigned long)pfn << 12); +} + struct vring_used_elem *virt_queue__set_used_elem(struct virt_queue *queue, u32 head, u32 len); u16 virt_queue__get_iov(struct virt_queue *queue, struct iovec iov[], u16 *out, u16 *in, struct kvm *kvm); diff --git a/tools/kvm/virtio/blk.c b/tools/kvm/virtio/blk.c index 12c7029..9f1aa1d 100644 --- a/tools/kvm/virtio/blk.c +++ b/tools/kvm/virtio/blk.c @@ -197,7 +197,7 @@ static bool virtio_blk_pci_io_out(struct kvm *self, u16 port, void *data, int si queue = &bdev->vqs[bdev->queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_pfn_to_host(self, queue->pfn); vring_init(&queue->vring, VIRTIO_BLK_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/console.c b/tools/kvm/virtio/console.c index f9031cb..87b816a 100644 --- a/tools/kvm/virtio/console.c +++ b/tools/kvm/virtio/console.c @@ -199,7 +199,7 @@ static bool virtio_console_pci_io_out(struct kvm *self, u16 port, void *data, in queue = &cdev.vqs[cdev.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_pfn_to_host(self, queue->pfn); vring_init(&queue->vring, VIRTIO_CONSOLE_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/net.c b/tools/kvm/virtio/net.c index 8d430e3..3f3ee22 100644 --- a/tools/kvm/virtio/net.c +++ b/tools/kvm/virtio/net.c @@ -245,7 +245,7 @@ static bool virtio_net_pci_io_out(struct kvm *self, u16 port, void *data, int si queue = &net_device.vqs[net_device.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_pfn_to_host(self, queue->pfn); vring_init(&queue->vring, VIRTIO_NET_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/rng.c b/tools/kvm/virtio/rng.c index f692dfd..1951d0d1c 100644 --- a/tools/kvm/virtio/rng.c +++ b/tools/kvm/virtio/rng.c @@ -129,7 +129,7 @@ static bool virtio_rng_pci_io_out(struct kvm *kvm, u16 port, void *data, int siz queue = &rdev.vqs[rdev.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(kvm, queue->pfn << 12); + p = guest_pfn_to_host(kvm, queue->pfn); vring_init(&queue->vring, VIRTIO_RNG_QUEUE_SIZE, p, 4096);