From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:58626)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kwolf@redhat.com>) id 1ZIfOE-0007ju-Eh
	for qemu-devel@nongnu.org; Fri, 24 Jul 2015 12:00:06 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <kwolf@redhat.com>) id 1ZIfOA-0002nN-Cx
	for qemu-devel@nongnu.org; Fri, 24 Jul 2015 12:00:02 -0400
Date: Fri, 24 Jul 2015 17:59:49 +0200
From: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20150724155949.GC3913@noname.redhat.com>
References: <cover.1437747831.git.jcody@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <cover.1437747831.git.jcody@redhat.com>
Subject: Re: [Qemu-devel] [PATCH v3 0/2] block: vpc - prevent overflow
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Jeff Cody <jcody@redhat.com>
Cc: qemu-stable@nongnu.org, stefanha@redhat.com, qemu-devel@nongnu.org, qemu-block@nongnu.org, mreitz@redhat.com

Am 24.07.2015 um 16:26 hat Jeff Cody geschrieben:
> Changes:
> 
> v3: check for INT_MAX / 4 as well, and use ROUND_UP (Thanks Max)
> 
> v2 now also checks that Max Table Entries is < SIZE_MAX / 4 (Thanks Stefan)
> 
> This series fixes a bug found by Richard Jones.
> 
> When we allocate the pagetable based on max_table_entries, we multiply
> the max table entry value by 4 to accomodate a table of 32-bit integers.
> However, max_table_entries is a uint32_t, and the VPC driver accepts
> ranges for that entry over 0x40000000.  So during this allocation:
> 
> s->pagetable = qemu_try_blockalign(bs->file, s->max_table_entries * 4);
> 
> The size arg overflows, allocating significantly less memory than
> expected.
> 
> Since qemu_try_blockalign() size argument is size_t, cast the
> multiplication correctly to prevent overflow.
> 
> The value of "max_table_entries * 4" is used elsewhere in the code as
> well, so store the correct value for use in all those cases.

Thanks, applied to my block branch for 2.4.

When posting patches that are meant for qemu-stable, it's best to not
only copy the mailing list for the emails, but to have an explicit
"Cc: qemu-stable@nongnu.org" in the commit message. I added the tag
for this series while applying.

Kevin