[Qemu-devel] [PATCH v4] vhost: fix log base address

[Qemu-devel] [PATCH v4] vhost: fix log base address

[Michael S. Tsirkin]

VHOST_SET_LOG_BASE got an incorrect address, causing
migration errors and potentially even memory corruption.

Reported-by: Wen Congyang <wency@cn.fujitsu.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---

changed (uint64_t)(unsigned long) to (uintptr_t).
Untested.
Wen Congyang, can you pls test and confirm.

 hw/virtio/vhost.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 8dd2f59..b83675f 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -288,7 +288,7 @@ static inline void vhost_dev_log_resize(struct vhost_dev* dev, uint64_t size)
     int r;
 
     log = g_malloc0(size * sizeof *log);
-    log_base = (uint64_t)(unsigned long)log;
+    log_base = (uintptr_t)log;
     r = dev->vhost_ops->vhost_call(dev, VHOST_SET_LOG_BASE, &log_base);
     assert(r >= 0);
     /* Sync only the range covered by the old log */
@@ -1016,10 +1016,13 @@ int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev)
     }
 
     if (hdev->log_enabled) {
+        uint64_t log_base;
+
         hdev->log_size = vhost_get_log_size(hdev);
         hdev->log = hdev->log_size ?
             g_malloc0(hdev->log_size * sizeof *hdev->log) : NULL;
-        r = hdev->vhost_ops->vhost_call(hdev, VHOST_SET_LOG_BASE, hdev->log);
+        log_base = (uintptr_t)hdev->log;
+        r = hdev->vhost_ops->vhost_call(hdev, VHOST_SET_LOG_BASE, &log_base);
         if (r < 0) {
             r = -errno;
             goto fail_log;
-- 
MST

Re: [Qemu-devel] [PATCH v4] vhost: fix log base address

[幽灵王子]

[-- Attachment #1: Type: text/plain, Size: 1656 bytes --]

At 2015/4/17 23:13, Michael S. Tsirkin Wrote:

VHOST_SET_LOG_BASE got an incorrect address, causing
migration errors and potentially even memory corruption.

Reported-by: Wen Congyang <wency@cn.fujitsu.com> <wency@cn.fujitsu.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com> <mst@redhat.com>
---

changed (uint64_t)(unsigned long) to (uintptr_t).
Untested.
Wen Congyang, can you pls test and confirm.


I test it, and it works for me.

Thanks
Wen Congyang


  hw/virtio/vhost.c | 7 +++++--
  1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 8dd2f59..b83675f 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -288,7 +288,7 @@ static inline void vhost_dev_log_resize(struct
vhost_dev* dev, uint64_t size)
      int r;

      log = g_malloc0(size * sizeof *log);
-    log_base = (uint64_t)(unsigned long)log;
+    log_base = (uintptr_t)log;
      r = dev->vhost_ops->vhost_call(dev, VHOST_SET_LOG_BASE, &log_base);
      assert(r >= 0);
      /* Sync only the range covered by the old log */
@@ -1016,10 +1016,13 @@ int vhost_dev_start(struct vhost_dev *hdev,
VirtIODevice *vdev)
      }

      if (hdev->log_enabled) {
+        uint64_t log_base;
+
          hdev->log_size = vhost_get_log_size(hdev);
          hdev->log = hdev->log_size ?
              g_malloc0(hdev->log_size * sizeof *hdev->log) : NULL;
-        r = hdev->vhost_ops->vhost_call(hdev, VHOST_SET_LOG_BASE,
hdev->log);
+        log_base = (uintptr_t)hdev->log;
+        r = hdev->vhost_ops->vhost_call(hdev, VHOST_SET_LOG_BASE,
&log_base);
          if (r < 0) {
              r = -errno;
              goto fail_log;

[-- Attachment #2: Type: text/html, Size: 2396 bytes --]

Re: [Qemu-devel] [PATCH v4] vhost: fix log base address

[Amos Kong]

On Fri, Apr 17, 2015 at 05:13:24PM +0200, Michael S. Tsirkin wrote:
> VHOST_SET_LOG_BASE got an incorrect address, causing
> migration errors and potentially even memory corruption.
> 
> Reported-by: Wen Congyang <wency@cn.fujitsu.com>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> ---
> 
> changed (uint64_t)(unsigned long) to (uintptr_t).
> Untested.
> Wen Congyang, can you pls test and confirm.
> 
>  hw/virtio/vhost.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)

All mentioned issues were addressed.
Reviewed-by: Amos Kong <akong@redhat.com>
 
> diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
> index 8dd2f59..b83675f 100644
> --- a/hw/virtio/vhost.c
> +++ b/hw/virtio/vhost.c
> @@ -288,7 +288,7 @@ static inline void vhost_dev_log_resize(struct vhost_dev* dev, uint64_t size)
>      int r;
>  
>      log = g_malloc0(size * sizeof *log);
> -    log_base = (uint64_t)(unsigned long)log;
> +    log_base = (uintptr_t)log;
>      r = dev->vhost_ops->vhost_call(dev, VHOST_SET_LOG_BASE, &log_base);
>      assert(r >= 0);
>      /* Sync only the range covered by the old log */
> @@ -1016,10 +1016,13 @@ int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev)
>      }
>  
>      if (hdev->log_enabled) {
> +        uint64_t log_base;
> +
>          hdev->log_size = vhost_get_log_size(hdev);
>          hdev->log = hdev->log_size ?
>              g_malloc0(hdev->log_size * sizeof *hdev->log) : NULL;
> -        r = hdev->vhost_ops->vhost_call(hdev, VHOST_SET_LOG_BASE, hdev->log);
> +        log_base = (uintptr_t)hdev->log;
> +        r = hdev->vhost_ops->vhost_call(hdev, VHOST_SET_LOG_BASE, &log_base);
>          if (r < 0) {
>              r = -errno;
>              goto fail_log;
> -- 
> MST

-- 
			Amos.

Re: [Qemu-devel] [PATCH v4] vhost: fix log base address

[Michael S. Tsirkin]

On Fri, Apr 17, 2015 at 05:13:24PM +0200, Michael S. Tsirkin wrote:
> VHOST_SET_LOG_BASE got an incorrect address, causing
> migration errors and potentially even memory corruption.
> 
> Reported-by: Wen Congyang <wency@cn.fujitsu.com>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> ---

OK, this passed testing now.
Peter, can you merge this directly for 2.3?

> 
> changed (uint64_t)(unsigned long) to (uintptr_t).
> Untested.
> Wen Congyang, can you pls test and confirm.
> 
>  hw/virtio/vhost.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
> index 8dd2f59..b83675f 100644
> --- a/hw/virtio/vhost.c
> +++ b/hw/virtio/vhost.c
> @@ -288,7 +288,7 @@ static inline void vhost_dev_log_resize(struct vhost_dev* dev, uint64_t size)
>      int r;
>  
>      log = g_malloc0(size * sizeof *log);
> -    log_base = (uint64_t)(unsigned long)log;
> +    log_base = (uintptr_t)log;
>      r = dev->vhost_ops->vhost_call(dev, VHOST_SET_LOG_BASE, &log_base);
>      assert(r >= 0);
>      /* Sync only the range covered by the old log */
> @@ -1016,10 +1016,13 @@ int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev)
>      }
>  
>      if (hdev->log_enabled) {
> +        uint64_t log_base;
> +
>          hdev->log_size = vhost_get_log_size(hdev);
>          hdev->log = hdev->log_size ?
>              g_malloc0(hdev->log_size * sizeof *hdev->log) : NULL;
> -        r = hdev->vhost_ops->vhost_call(hdev, VHOST_SET_LOG_BASE, hdev->log);
> +        log_base = (uintptr_t)hdev->log;
> +        r = hdev->vhost_ops->vhost_call(hdev, VHOST_SET_LOG_BASE, &log_base);
>          if (r < 0) {
>              r = -errno;
>              goto fail_log;
> -- 
> MST

Re: [Qemu-devel] [PATCH v4] vhost: fix log base address

[Peter Maydell]

On 20 April 2015 at 07:07, Michael S. Tsirkin <mst@redhat.com> wrote:
> On Fri, Apr 17, 2015 at 05:13:24PM +0200, Michael S. Tsirkin wrote:
>> VHOST_SET_LOG_BASE got an incorrect address, causing
>> migration errors and potentially even memory corruption.
>>
>> Reported-by: Wen Congyang <wency@cn.fujitsu.com>
>> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
>> ---
>
> OK, this passed testing now.
> Peter, can you merge this directly for 2.3?

Applied, thanks.

-- PMM