From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56751) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XqDgO-0006tB-PA for qemu-devel@nongnu.org; Sun, 16 Nov 2014 23:13:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XqDgF-0008Qs-Fp for qemu-devel@nongnu.org; Sun, 16 Nov 2014 23:12:56 -0500 Received: from e23smtp08.au.ibm.com ([202.81.31.141]:39624) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XqDgE-0008Qa-QO for qemu-devel@nongnu.org; Sun, 16 Nov 2014 23:12:47 -0500 Received: from /spool/local by e23smtp08.au.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 17 Nov 2014 14:12:42 +1000 From: Samuel Mendoza-Jonas Date: Mon, 17 Nov 2014 15:12:29 +1100 Message-Id: <1416197550-19708-3-git-send-email-sam.mj@au1.ibm.com> In-Reply-To: <1416197550-19708-1-git-send-email-sam.mj@au1.ibm.com> References: <1416197550-19708-1-git-send-email-sam.mj@au1.ibm.com> Subject: [Qemu-devel] [PATCH V2 2/3] spapr: Fix integer overflow during migration (TCG) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-ppc@nongnu.org, qemu-devel@nongnu.org Cc: aik@ozlabs.ru, Samuel Mendoza-Jonas The n_valid and n_invalid fields are unsigned short integers but it is possible to have more than 65535 entries in a contiguous hunk, overflowing the field. This results in an incorrect HTAB being sent to the destination during migration. Signed-off-by: Samuel Mendoza-Jonas --- hw/ppc/spapr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c index eb07343..10b7b00 100644 --- a/hw/ppc/spapr.c +++ b/hw/ppc/spapr.c @@ -1045,7 +1045,7 @@ static void htab_save_first_pass(QEMUFile *f, sPAPREnvironment *spapr, /* Consume valid HPTEs */ chunkstart = index; - while ((index < htabslots) + while ((index < htabslots) && (index - chunkstart < USHRT_MAX) && HPTE_VALID(HPTE(spapr->htab, index))) { index++; CLEAN_HPTE(HPTE(spapr->htab, index)); @@ -1097,7 +1097,7 @@ static int htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr, chunkstart = index; /* Consume valid dirty HPTEs */ - while ((index < htabslots) + while ((index < htabslots) && (index - chunkstart < USHRT_MAX) && HPTE_DIRTY(HPTE(spapr->htab, index)) && HPTE_VALID(HPTE(spapr->htab, index))) { CLEAN_HPTE(HPTE(spapr->htab, index)); @@ -1107,7 +1107,7 @@ static int htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr, invalidstart = index; /* Consume invalid dirty HPTEs */ - while ((index < htabslots) + while ((index < htabslots) && (index - invalidstart < USHRT_MAX) && HPTE_DIRTY(HPTE(spapr->htab, index)) && !HPTE_VALID(HPTE(spapr->htab, index))) { CLEAN_HPTE(HPTE(spapr->htab, index)); -- 1.9.3