* KVM: properly check max PIC pin in irq route setup
@ 2010-01-12 18:42 Marcelo Tosatti
2010-01-12 19:45 ` Juan Quintela
2010-01-17 13:00 ` Avi Kivity
0 siblings, 2 replies; 3+ messages in thread
From: Marcelo Tosatti @ 2010-01-12 18:42 UTC (permalink / raw)
To: kvm; +Cc: Avi Kivity, Gleb Natapov, Juan Quintela
Otherwise memory beyond irq_states[16] might be accessed.
Noticed by Juan Quintela.
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
diff --git a/virt/kvm/irq_comm.c b/virt/kvm/irq_comm.c
index 9b07734..9fd5b3e 100644
--- a/virt/kvm/irq_comm.c
+++ b/virt/kvm/irq_comm.c
@@ -302,6 +302,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
{
int r = -EINVAL;
int delta;
+ unsigned max_pin;
struct kvm_kernel_irq_routing_entry *ei;
struct hlist_node *n;
@@ -322,12 +323,15 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
switch (ue->u.irqchip.irqchip) {
case KVM_IRQCHIP_PIC_MASTER:
e->set = kvm_set_pic_irq;
+ max_pin = 16;
break;
case KVM_IRQCHIP_PIC_SLAVE:
e->set = kvm_set_pic_irq;
+ max_pin = 16;
delta = 8;
break;
case KVM_IRQCHIP_IOAPIC:
+ max_pin = KVM_IOAPIC_NUM_PINS;
e->set = kvm_set_ioapic_irq;
break;
default:
@@ -335,7 +339,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
}
e->irqchip.irqchip = ue->u.irqchip.irqchip;
e->irqchip.pin = ue->u.irqchip.pin + delta;
- if (e->irqchip.pin >= KVM_IOAPIC_NUM_PINS)
+ if (e->irqchip.pin >= max_pin)
goto out;
rt->chip[ue->u.irqchip.irqchip][e->irqchip.pin] = ue->gsi;
break;
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: KVM: properly check max PIC pin in irq route setup
2010-01-12 18:42 KVM: properly check max PIC pin in irq route setup Marcelo Tosatti
@ 2010-01-12 19:45 ` Juan Quintela
2010-01-17 13:00 ` Avi Kivity
1 sibling, 0 replies; 3+ messages in thread
From: Juan Quintela @ 2010-01-12 19:45 UTC (permalink / raw)
To: Marcelo Tosatti; +Cc: kvm, Avi Kivity, Gleb Natapov
Marcelo Tosatti <mtosatti@redhat.com> wrote:
> Otherwise memory beyond irq_states[16] might be accessed.
>
> Noticed by Juan Quintela.
>
> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
>
> diff --git a/virt/kvm/irq_comm.c b/virt/kvm/irq_comm.c
> index 9b07734..9fd5b3e 100644
> --- a/virt/kvm/irq_comm.c
> +++ b/virt/kvm/irq_comm.c
> @@ -302,6 +302,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
> {
> int r = -EINVAL;
> int delta;
> + unsigned max_pin;
> struct kvm_kernel_irq_routing_entry *ei;
> struct hlist_node *n;
>
> @@ -322,12 +323,15 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
> switch (ue->u.irqchip.irqchip) {
> case KVM_IRQCHIP_PIC_MASTER:
> e->set = kvm_set_pic_irq;
> + max_pin = 16;
once you are here, you can use the constant name:
PIC_NUM_PINS
Humm, that is not going to fly, it is defined in x86 code, and it is
used in generic code.
No great ideas here :(
> break;
> case KVM_IRQCHIP_PIC_SLAVE:
> e->set = kvm_set_pic_irq;
> + max_pin = 16;
> delta = 8;
> break;
> case KVM_IRQCHIP_IOAPIC:
> + max_pin = KVM_IOAPIC_NUM_PINS;
> e->set = kvm_set_ioapic_irq;
> break;
> default:
> @@ -335,7 +339,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
> }
> e->irqchip.irqchip = ue->u.irqchip.irqchip;
> e->irqchip.pin = ue->u.irqchip.pin + delta;
> - if (e->irqchip.pin >= KVM_IOAPIC_NUM_PINS)
> + if (e->irqchip.pin >= max_pin)
> goto out;
> rt->chip[ue->u.irqchip.irqchip][e->irqchip.pin] = ue->gsi;
> break;
For the rest, patch fixes my concerns.
Acked-by: Juan Quintela <quintela@redhat.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: KVM: properly check max PIC pin in irq route setup
2010-01-12 18:42 KVM: properly check max PIC pin in irq route setup Marcelo Tosatti
2010-01-12 19:45 ` Juan Quintela
@ 2010-01-17 13:00 ` Avi Kivity
1 sibling, 0 replies; 3+ messages in thread
From: Avi Kivity @ 2010-01-17 13:00 UTC (permalink / raw)
To: Marcelo Tosatti; +Cc: kvm, Gleb Natapov, Juan Quintela
On 01/12/2010 08:42 PM, Marcelo Tosatti wrote:
> Otherwise memory beyond irq_states[16] might be accessed.
>
> Noticed by Juan Quintela.
>
>
Applied and queued; thanks.
--
error compiling committee.c: too many arguments to function
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-01-17 13:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-01-12 18:42 KVM: properly check max PIC pin in irq route setup Marcelo Tosatti
2010-01-12 19:45 ` Juan Quintela
2010-01-17 13:00 ` Avi Kivity
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox