From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:44782) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UfvOs-0001m0-9V for qemu-devel@nongnu.org; Fri, 24 May 2013 13:03:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UfvOn-00012X-Ds for qemu-devel@nongnu.org; Fri, 24 May 2013 13:03:30 -0400 Received: from mail-ee0-f52.google.com ([74.125.83.52]:61760) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UfvOn-00012J-85 for qemu-devel@nongnu.org; Fri, 24 May 2013 13:03:25 -0400 Received: by mail-ee0-f52.google.com with SMTP id c13so2751904eek.39 for ; Fri, 24 May 2013 10:03:24 -0700 (PDT) Received: from playground.lan (net-37-117-138-128.cust.dsl.vodafone.it. [37.117.138.128]) by mx.google.com with ESMTPSA id z52sm24872219eea.1.2013.05.24.10.03.22 for (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Fri, 24 May 2013 10:03:23 -0700 (PDT) Sender: Paolo Bonzini From: Paolo Bonzini Date: Fri, 24 May 2013 19:02:57 +0200 Message-Id: <1369414987-8839-6-git-send-email-pbonzini@redhat.com> In-Reply-To: <1369414987-8839-1-git-send-email-pbonzini@redhat.com> References: <1369414987-8839-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH 05/15] memory: assert that PhysPageEntry's ptr does not overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org While sized to 15 bits in PhysPageEntry, the ptr field is ORed into the iotlb entries together with a page-aligned pointer. The ptr field must not overflow into this page-aligned value, assert that it is smaller than the page size. Reviewed-by: Peter Maydell Signed-off-by: Paolo Bonzini --- exec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/exec.c b/exec.c index 1355661..8562fca 100644 --- a/exec.c +++ b/exec.c @@ -713,6 +713,12 @@ static void destroy_all_mappings(AddressSpaceDispatch *d) static uint16_t phys_section_add(MemoryRegionSection *section) { + /* The physical section number is ORed with a page-aligned + * pointer to produce the iotlb entries. Thus it should + * never overflow into the page-aligned value. + */ + assert(phys_sections_nb < TARGET_PAGE_SIZE); + if (phys_sections_nb == phys_sections_nb_alloc) { phys_sections_nb_alloc = MAX(phys_sections_nb_alloc * 2, 16); phys_sections = g_renew(MemoryRegionSection, phys_sections, -- 1.8.1.4