* [Qemu-devel] [PATCH] target-i386: avoid overflow in the tsc-frequency property
@ 2015-06-24 12:11 Paolo Bonzini
2015-06-25 17:40 ` Eduardo Habkost
0 siblings, 1 reply; 2+ messages in thread
From: Paolo Bonzini @ 2015-06-24 12:11 UTC (permalink / raw)
To: qemu-devel; +Cc: ehabkost
The TSC frequency fits comfortably in an int when expressed in kHz,
but it may overflow when converted to Hz. In this case,
tsc-frequency returns a negative value because x86_cpuid_get_tsc_freq
does a 32-bit multiplication before assigning to int64_t.
For simplicity just make tsc_khz a 64-bit value.
Spotted by Coverity.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
target-i386/cpu.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 603aaf0..2125049 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -958,7 +958,7 @@ typedef struct CPUX86State {
uint8_t has_error_code;
uint32_t sipi_vector;
bool tsc_valid;
- int tsc_khz;
+ int64_t tsc_khz;
void *kvm_xsave_buf;
uint64_t mcg_cap;
--
2.4.3
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [Qemu-devel] [PATCH] target-i386: avoid overflow in the tsc-frequency property
2015-06-24 12:11 [Qemu-devel] [PATCH] target-i386: avoid overflow in the tsc-frequency property Paolo Bonzini
@ 2015-06-25 17:40 ` Eduardo Habkost
0 siblings, 0 replies; 2+ messages in thread
From: Eduardo Habkost @ 2015-06-25 17:40 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: qemu-devel
On Wed, Jun 24, 2015 at 02:11:27PM +0200, Paolo Bonzini wrote:
> The TSC frequency fits comfortably in an int when expressed in kHz,
> but it may overflow when converted to Hz. In this case,
> tsc-frequency returns a negative value because x86_cpuid_get_tsc_freq
> does a 32-bit multiplication before assigning to int64_t.
>
> For simplicity just make tsc_khz a 64-bit value.
>
> Spotted by Coverity.
>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Applied to the x86 tree. Thanks!
--
Eduardo
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-06-25 17:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-06-24 12:11 [Qemu-devel] [PATCH] target-i386: avoid overflow in the tsc-frequency property Paolo Bonzini
2015-06-25 17:40 ` Eduardo Habkost
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).