From patchwork Tue Sep 16 13:39:50 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luiz Capitulino X-Patchwork-Id: 390072 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 1F483140111 for ; Tue, 16 Sep 2014 23:41:14 +1000 (EST) Received: from localhost ([::1]:38061 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XTt0K-0004km-2i for incoming@patchwork.ozlabs.org; Tue, 16 Sep 2014 09:41:12 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42000) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XTszK-0002f4-K5 for qemu-devel@nongnu.org; Tue, 16 Sep 2014 09:40:18 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XTsz8-00023B-Bw for qemu-devel@nongnu.org; Tue, 16 Sep 2014 09:40:10 -0400 Received: from mx1.redhat.com ([209.132.183.28]:3362) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XTsz8-0001zq-5G; Tue, 16 Sep 2014 09:39:58 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s8GDdsMv011777 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Tue, 16 Sep 2014 09:39:54 -0400 Received: from localhost (ovpn-116-39.ams2.redhat.com [10.36.116.39]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id s8GDdqGE030931; Tue, 16 Sep 2014 09:39:52 -0400 Date: Tue, 16 Sep 2014 09:39:50 -0400 From: Luiz Capitulino To: qemu-devel Message-ID: <20140916093950.4339b5b9@redhat.com> Organization: Red Hat MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: qemu-stable@nongnu.org, armbru@redhat.com Subject: [Qemu-devel] [PATCH v2] virtio-balloon: fix integer overflow in memory stats feature X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org When a QMP client changes the polling interval time by setting the guest-stats-polling-interval property, the interval value is stored and manipulated as an int64_t variable. However, the balloon_stats_change_timer() function, which is used to set the actual timer with the interval value, takes an int instead, causing an overflow for big interval values. This commit fix this bug by changing balloon_stats_change_timer() to take an int64_t and also it limits the polling interval value to UINT_MAX to avoid other kinds of overflow. Signed-off-by: Luiz Capitulino Reviewed-by: Eric Blake Reviewed-by: Markus Armbruster --- hw/virtio/virtio-balloon.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index 2c30b3d..b5cf7ca 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s) } } -static void balloon_stats_change_timer(VirtIOBalloon *s, int secs) +static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs) { timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000); } @@ -170,6 +170,11 @@ static void balloon_stats_set_poll_interval(Object *obj, struct Visitor *v, return; } + if (value > UINT_MAX) { + error_setg(errp, "timer value is too big"); + return; + } + if (value == s->stats_poll_interval) { return; }