From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54581) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9cSe-0005JP-EV for qemu-devel@nongnu.org; Fri, 09 Jan 2015 11:30:57 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y9cSa-0001zt-8W for qemu-devel@nongnu.org; Fri, 09 Jan 2015 11:30:56 -0500 Received: from mx1.redhat.com ([209.132.183.28]:56091) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9cSa-0001zp-0m for qemu-devel@nongnu.org; Fri, 09 Jan 2015 11:30:52 -0500 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t09GUpge015147 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Fri, 9 Jan 2015 11:30:51 -0500 From: Alex Williamson Date: Fri, 09 Jan 2015 09:30:50 -0700 Message-ID: <20150109163050.23623.90944.stgit@bling.home> In-Reply-To: <20150109162948.23623.92260.stgit@bling.home> References: <20150109162948.23623.92260.stgit@bling.home> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [PULL 1/2] vfio-pci: Fix BAR size overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: alex.williamson@redhat.com We use an unsigned int when working with the PCI BAR size, which can obviously overflow if the BAR is 4GB or larger. This needs to change to a fixed length uint64_t. A similar issue is possible, though even more unlikely, when mapping the region above an MSI-X table. The start of the MSI-X vector table must be below 4GB, but the end, and therefore the start of the next mapping region, could still land at 4GB. Suggested-by: Nishank Trivedi Signed-off-by: Alex Williamson Reviewed-by: Don Slutz Tested-by: Alexey Kardashevskiy --- hw/vfio/pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c index b4e73d1..b6703c7 100644 --- a/hw/vfio/pci.c +++ b/hw/vfio/pci.c @@ -2301,7 +2301,7 @@ static void vfio_unmap_bar(VFIOPCIDevice *vdev, int nr) static void vfio_map_bar(VFIOPCIDevice *vdev, int nr) { VFIOBAR *bar = &vdev->bars[nr]; - unsigned size = bar->region.size; + uint64_t size = bar->region.size; char name[64]; uint32_t pci_bar; uint8_t type; @@ -2351,7 +2351,7 @@ static void vfio_map_bar(VFIOPCIDevice *vdev, int nr) } if (vdev->msix && vdev->msix->table_bar == nr) { - unsigned start; + uint64_t start; start = HOST_PAGE_ALIGN(vdev->msix->table_offset + (vdev->msix->entries * PCI_MSIX_ENTRY_SIZE));