From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60523) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9H03-0004HZ-65 for qemu-devel@nongnu.org; Thu, 08 Jan 2015 12:36:23 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y9Gzo-0006m8-Ky for qemu-devel@nongnu.org; Thu, 08 Jan 2015 12:35:59 -0500 Received: from e33.co.us.ibm.com ([32.97.110.151]:37744) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9Gzn-0006lF-QM for qemu-devel@nongnu.org; Thu, 08 Jan 2015 12:35:44 -0500 Received: from /spool/local by e33.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 8 Jan 2015 10:35:43 -0700 From: Michael Roth Date: Thu, 8 Jan 2015 11:33:23 -0600 Message-Id: <1420738472-23267-20-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1420738472-23267-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1420738472-23267-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 19/88] virtio-balloon: fix integer overflow in memory stats feature List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org From: Luiz Capitulino When a QMP client changes the polling interval time by setting the guest-stats-polling-interval property, the interval value is stored and manipulated as an int64_t variable. However, the balloon_stats_change_timer() function, which is used to set the actual timer with the interval value, takes an int instead, causing an overflow for big interval values. This commit fix this bug by changing balloon_stats_change_timer() to take an int64_t and also it limits the polling interval value to UINT_MAX to avoid other kinds of overflow. Signed-off-by: Luiz Capitulino Reviewed-by: Eric Blake Reviewed-by: Markus Armbruster (cherry picked from commit 1f9296b51a26650916a2c4191268bb64057bdc5f) Signed-off-by: Michael Roth --- hw/virtio/virtio-balloon.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index 2c30b3d..b5cf7ca 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s) } } -static void balloon_stats_change_timer(VirtIOBalloon *s, int secs) +static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs) { timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000); } @@ -170,6 +170,11 @@ static void balloon_stats_set_poll_interval(Object *obj, struct Visitor *v, return; } + if (value > UINT_MAX) { + error_setg(errp, "timer value is too big"); + return; + } + if (value == s->stats_poll_interval) { return; } -- 1.9.1