From patchwork Wed Jan 7 17:23:52 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Williamson X-Patchwork-Id: 426347 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 1CD9D1400D5 for ; Thu, 8 Jan 2015 04:24:19 +1100 (AEDT) Received: from localhost ([::1]:42032 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y8uL9-0004Tv-VA for incoming@patchwork.ozlabs.org; Wed, 07 Jan 2015 12:24:15 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46845) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y8uKs-00045l-W0 for qemu-devel@nongnu.org; Wed, 07 Jan 2015 12:23:59 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y8uKo-0007lq-9g for qemu-devel@nongnu.org; Wed, 07 Jan 2015 12:23:58 -0500 Received: from mx1.redhat.com ([209.132.183.28]:41890) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y8uKo-0007lg-2m for qemu-devel@nongnu.org; Wed, 07 Jan 2015 12:23:54 -0500 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t07HNrc8019024 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Wed, 7 Jan 2015 12:23:53 -0500 Received: from gimli.home (ovpn-113-150.phx2.redhat.com [10.3.113.150]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t07HNqjD018683; Wed, 7 Jan 2015 12:23:53 -0500 From: Alex Williamson To: qemu-devel@nongnu.org Date: Wed, 07 Jan 2015 10:23:52 -0700 Message-ID: <20150107172040.29974.56600.stgit@gimli.home> User-Agent: StGIT/0.14.3 MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: alex.williamson@redhat.com Subject: [Qemu-devel] [PATCH v2] vfio-pci: Fix BAR size overflow X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org We use an unsigned int when working with the PCI BAR size, which can obviously overflow if the BAR is 4GB or larger. This needs to change to a fixed length uint64_t. A similar issue is possible, though even more unlikely, when mapping the region above an MSI-X table. The start of the MSI-X vector table must be below 4GB, but the end, and therefore the start of the next mapping region, could still land at 4GB. Suggested-by: Nishank Trivedi Signed-off-by: Alex Williamson Reviewed-by: Don Slutz Tested-by: Alexey Kardashevskiy --- v2: s/unsigned long/uint64_t/, duh hw/vfio/pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index b4e73d1..b6703c7 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -2301,7 +2301,7 @@ static void vfio_unmap_bar(VFIOPCIDevice *vdev, int nr) static void vfio_map_bar(VFIOPCIDevice *vdev, int nr) { VFIOBAR *bar = &vdev->bars[nr]; - unsigned size = bar->region.size; + uint64_t size = bar->region.size; char name[64]; uint32_t pci_bar; uint8_t type; @@ -2351,7 +2351,7 @@ static void vfio_map_bar(VFIOPCIDevice *vdev, int nr) } if (vdev->msix && vdev->msix->table_bar == nr) { - unsigned start; + uint64_t start; start = HOST_PAGE_ALIGN(vdev->msix->table_offset + (vdev->msix->entries * PCI_MSIX_ENTRY_SIZE));