From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43336) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y8hSo-0007hG-V9 for qemu-devel@nongnu.org; Tue, 06 Jan 2015 22:39:20 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y8hSl-0007gU-PM for qemu-devel@nongnu.org; Tue, 06 Jan 2015 22:39:18 -0500 Received: from mx3-phx2.redhat.com ([209.132.183.24]:42012) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y8hSl-0007gJ-Gw for qemu-devel@nongnu.org; Tue, 06 Jan 2015 22:39:15 -0500 Date: Tue, 6 Jan 2015 22:39:13 -0500 (EST) From: Alex Williamson Message-ID: <1800991945.5628263.1420601953220.JavaMail.zimbra@redhat.com> In-Reply-To: <54ACA2A8.50102@terremark.com> References: <20150107000121.13777.54926.stgit@gimli.home> <54ACA2A8.50102@terremark.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] vfio-pci: Fix BAR size overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Don Slutz Cc: qemu-devel@nongnu.org ----- Original Message ----- > On 01/06/15 19:03, Alex Williamson wrote: > > We use an unsigned int when working with the PCI BAR size, which can > > obviously overflow if the BAR is 4GB or larger. This needs to change > > to an unsigned long. A similar issue is possible, though even more > > unlikely, when mapping the region above an MSI-X table. The start of > > the table must be below 4GB, but the end, and therefore the start of > > the next mapping region, could still land at 4GB. > > > > Suggested-by: Nishank Trivedi > > Signed-off-by: Alex Williamson > > --- > > > > hw/vfio/pci.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c > > index b4e73d1..03790a8 100644 > > --- a/hw/vfio/pci.c > > +++ b/hw/vfio/pci.c > > @@ -2301,7 +2301,7 @@ static void vfio_unmap_bar(VFIOPCIDevice *vdev, int > > nr) > > static void vfio_map_bar(VFIOPCIDevice *vdev, int nr) > > { > > VFIOBAR *bar = &vdev->bars[nr]; > > - unsigned size = bar->region.size; > > + unsigned long size = bar->region.size; > > On a 32bit build, this does not fix the issue. Very true. Thanks for the review, Alex > > char name[64]; > > uint32_t pci_bar; > > uint8_t type; > > @@ -2351,7 +2351,7 @@ static void vfio_map_bar(VFIOPCIDevice *vdev, int nr) > > } > > > > if (vdev->msix && vdev->msix->table_bar == nr) { > > - unsigned start; > > + unsigned long start; > > > > start = HOST_PAGE_ALIGN(vdev->msix->table_offset + > > (vdev->msix->entries * > > PCI_MSIX_ENTRY_SIZE)); > > > > > >