* [Qemu-devel] [PATCH v2] virtio-balloon: fix integer overflow in memory stats feature
@ 2014-09-16 13:39 Luiz Capitulino
2014-09-16 13:55 ` Eric Blake
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Luiz Capitulino @ 2014-09-16 13:39 UTC (permalink / raw)
To: qemu-devel; +Cc: qemu-stable, armbru
When a QMP client changes the polling interval time by setting
the guest-stats-polling-interval property, the interval value
is stored and manipulated as an int64_t variable.
However, the balloon_stats_change_timer() function, which is
used to set the actual timer with the interval value, takes
an int instead, causing an overflow for big interval values.
This commit fix this bug by changing balloon_stats_change_timer()
to take an int64_t and also it limits the polling interval value
to UINT_MAX to avoid other kinds of overflow.
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
---
hw/virtio/virtio-balloon.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 2c30b3d..b5cf7ca 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s)
}
}
-static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
+static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
{
timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
}
@@ -170,6 +170,11 @@ static void balloon_stats_set_poll_interval(Object *obj, struct Visitor *v,
return;
}
+ if (value > UINT_MAX) {
+ error_setg(errp, "timer value is too big");
+ return;
+ }
+
if (value == s->stats_poll_interval) {
return;
}
--
1.9.3
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [Qemu-devel] [PATCH v2] virtio-balloon: fix integer overflow in memory stats feature
2014-09-16 13:39 [Qemu-devel] [PATCH v2] virtio-balloon: fix integer overflow in memory stats feature Luiz Capitulino
@ 2014-09-16 13:55 ` Eric Blake
2014-09-16 15:02 ` Michael S. Tsirkin
2014-09-16 15:08 ` Markus Armbruster
2 siblings, 0 replies; 5+ messages in thread
From: Eric Blake @ 2014-09-16 13:55 UTC (permalink / raw)
To: Luiz Capitulino, qemu-devel; +Cc: qemu-stable, armbru
[-- Attachment #1: Type: text/plain, Size: 939 bytes --]
On 09/16/2014 07:39 AM, Luiz Capitulino wrote:
> When a QMP client changes the polling interval time by setting
> the guest-stats-polling-interval property, the interval value
> is stored and manipulated as an int64_t variable.
>
> However, the balloon_stats_change_timer() function, which is
> used to set the actual timer with the interval value, takes
> an int instead, causing an overflow for big interval values.
>
> This commit fix this bug by changing balloon_stats_change_timer()
> to take an int64_t and also it limits the polling interval value
> to UINT_MAX to avoid other kinds of overflow.
>
> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
> ---
> hw/virtio/virtio-balloon.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
Reviewed-by: Eric Blake <eblake@redhat.com>
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 539 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH v2] virtio-balloon: fix integer overflow in memory stats feature
2014-09-16 13:39 [Qemu-devel] [PATCH v2] virtio-balloon: fix integer overflow in memory stats feature Luiz Capitulino
2014-09-16 13:55 ` Eric Blake
@ 2014-09-16 15:02 ` Michael S. Tsirkin
2014-09-16 14:02 ` Luiz Capitulino
2014-09-16 15:08 ` Markus Armbruster
2 siblings, 1 reply; 5+ messages in thread
From: Michael S. Tsirkin @ 2014-09-16 15:02 UTC (permalink / raw)
To: Luiz Capitulino; +Cc: armbru, qemu-devel, qemu-stable
On Tue, Sep 16, 2014 at 09:39:50AM -0400, Luiz Capitulino wrote:
> When a QMP client changes the polling interval time by setting
> the guest-stats-polling-interval property, the interval value
> is stored and manipulated as an int64_t variable.
>
> However, the balloon_stats_change_timer() function, which is
> used to set the actual timer with the interval value, takes
> an int instead, causing an overflow for big interval values.
>
> This commit fix this bug by changing balloon_stats_change_timer()
> to take an int64_t and also it limits the polling interval value
> to UINT_MAX to avoid other kinds of overflow.
>
> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
OK but pls remember to Cc qemu-stable on bugfixes.
> ---
> hw/virtio/virtio-balloon.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> index 2c30b3d..b5cf7ca 100644
> --- a/hw/virtio/virtio-balloon.c
> +++ b/hw/virtio/virtio-balloon.c
> @@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s)
> }
> }
>
> -static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
> +static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
> {
> timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
> }
> @@ -170,6 +170,11 @@ static void balloon_stats_set_poll_interval(Object *obj, struct Visitor *v,
> return;
> }
>
> + if (value > UINT_MAX) {
> + error_setg(errp, "timer value is too big");
> + return;
> + }
> +
> if (value == s->stats_poll_interval) {
> return;
> }
> --
> 1.9.3
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [Qemu-devel] [PATCH v2] virtio-balloon: fix integer overflow in memory stats feature
2014-09-16 15:02 ` Michael S. Tsirkin
@ 2014-09-16 14:02 ` Luiz Capitulino
0 siblings, 0 replies; 5+ messages in thread
From: Luiz Capitulino @ 2014-09-16 14:02 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: armbru, qemu-devel, qemu-stable
On Tue, 16 Sep 2014 18:02:54 +0300
"Michael S. Tsirkin" <mst@redhat.com> wrote:
> On Tue, Sep 16, 2014 at 09:39:50AM -0400, Luiz Capitulino wrote:
> > When a QMP client changes the polling interval time by setting
> > the guest-stats-polling-interval property, the interval value
> > is stored and manipulated as an int64_t variable.
> >
> > However, the balloon_stats_change_timer() function, which is
> > used to set the actual timer with the interval value, takes
> > an int instead, causing an overflow for big interval values.
> >
> > This commit fix this bug by changing balloon_stats_change_timer()
> > to take an int64_t and also it limits the polling interval value
> > to UINT_MAX to avoid other kinds of overflow.
> >
> > Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
>
> OK but pls remember to Cc qemu-stable on bugfixes.
I did.
>
> > ---
>
> > hw/virtio/virtio-balloon.c | 7 ++++++-
> > 1 file changed, 6 insertions(+), 1 deletion(-)
> >
> > diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> > index 2c30b3d..b5cf7ca 100644
> > --- a/hw/virtio/virtio-balloon.c
> > +++ b/hw/virtio/virtio-balloon.c
> > @@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s)
> > }
> > }
> >
> > -static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
> > +static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
> > {
> > timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
> > }
> > @@ -170,6 +170,11 @@ static void balloon_stats_set_poll_interval(Object *obj, struct Visitor *v,
> > return;
> > }
> >
> > + if (value > UINT_MAX) {
> > + error_setg(errp, "timer value is too big");
> > + return;
> > + }
> > +
> > if (value == s->stats_poll_interval) {
> > return;
> > }
> > --
> > 1.9.3
> >
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH v2] virtio-balloon: fix integer overflow in memory stats feature
2014-09-16 13:39 [Qemu-devel] [PATCH v2] virtio-balloon: fix integer overflow in memory stats feature Luiz Capitulino
2014-09-16 13:55 ` Eric Blake
2014-09-16 15:02 ` Michael S. Tsirkin
@ 2014-09-16 15:08 ` Markus Armbruster
2 siblings, 0 replies; 5+ messages in thread
From: Markus Armbruster @ 2014-09-16 15:08 UTC (permalink / raw)
To: Luiz Capitulino; +Cc: qemu-devel, qemu-stable
Luiz Capitulino <lcapitulino@redhat.com> writes:
> When a QMP client changes the polling interval time by setting
> the guest-stats-polling-interval property, the interval value
> is stored and manipulated as an int64_t variable.
>
> However, the balloon_stats_change_timer() function, which is
> used to set the actual timer with the interval value, takes
> an int instead, causing an overflow for big interval values.
>
> This commit fix this bug by changing balloon_stats_change_timer()
> to take an int64_t and also it limits the polling interval value
> to UINT_MAX to avoid other kinds of overflow.
>
> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2014-09-16 15:08 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-09-16 13:39 [Qemu-devel] [PATCH v2] virtio-balloon: fix integer overflow in memory stats feature Luiz Capitulino
2014-09-16 13:55 ` Eric Blake
2014-09-16 15:02 ` Michael S. Tsirkin
2014-09-16 14:02 ` Luiz Capitulino
2014-09-16 15:08 ` Markus Armbruster
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).