[Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature

[Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature

[Luiz Capitulino]

When a QMP client changes the polling interval time by setting
the guest-stats-polling-interval property, the interval value
is stored and manipuled as an int64_t variable.

However, the balloon_stats_change_timer() function, which is
used to set the actual timer with the interval value, takes
an int instead, causing an overflow for big interval values.

Fix it.

Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
---
 hw/virtio/virtio-balloon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 2c30b3d..9629264 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s)
     }
 }
 
-static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
+static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
 {
     timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
 }
-- 
1.9.3

Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature

[Eric Blake]

[-- Attachment #1: Type: text/plain, Size: 1345 bytes --]

On 09/15/2014 12:09 PM, Luiz Capitulino wrote:
> When a QMP client changes the polling interval time by setting
> the guest-stats-polling-interval property, the interval value
> is stored and manipuled as an int64_t variable.
> 

s/manipuled/manipulated/

> However, the balloon_stats_change_timer() function, which is
> used to set the actual timer with the interval value, takes
> an int instead, causing an overflow for big interval values.
> 
> Fix it.
> 
> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
> ---
>  hw/virtio/virtio-balloon.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> index 2c30b3d..9629264 100644
> --- a/hw/virtio/virtio-balloon.c
> +++ b/hw/virtio/virtio-balloon.c
> @@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s)
>      }
>  }
>  
> -static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
> +static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
>  {
>      timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);

secs * 1000 can still overflow for (really large) values, do we care
about that?

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 539 bytes --]

Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature

[Luiz Capitulino]

On Mon, 15 Sep 2014 13:16:01 -0600
Eric Blake <eblake@redhat.com> wrote:

> On 09/15/2014 12:09 PM, Luiz Capitulino wrote:
> > When a QMP client changes the polling interval time by setting
> > the guest-stats-polling-interval property, the interval value
> > is stored and manipuled as an int64_t variable.
> > 
> 
> s/manipuled/manipulated/
> 
> > However, the balloon_stats_change_timer() function, which is
> > used to set the actual timer with the interval value, takes
> > an int instead, causing an overflow for big interval values.
> > 
> > Fix it.
> > 
> > Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
> > ---
> >  hw/virtio/virtio-balloon.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> > index 2c30b3d..9629264 100644
> > --- a/hw/virtio/virtio-balloon.c
> > +++ b/hw/virtio/virtio-balloon.c
> > @@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s)
> >      }
> >  }
> >  
> > -static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
> > +static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
> >  {
> >      timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
> 
> secs * 1000 can still overflow for (really large) values, do we care
> about that?

Hmm, good point. I think I could keep the s/int/int64_t change but limit secs
to UINT_MAX for simplicity. I guess we don't expect anyone to set this to
billions of seconds in the future :)

Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature

[Markus Armbruster]

Luiz Capitulino <lcapitulino@redhat.com> writes:

> When a QMP client changes the polling interval time by setting
> the guest-stats-polling-interval property, the interval value
> is stored and manipuled as an int64_t variable.
>
> However, the balloon_stats_change_timer() function, which is
> used to set the actual timer with the interval value, takes
> an int instead, causing an overflow for big interval values.
>
> Fix it.
>
> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>

Subject claims buffer overflow, but description suggests integer
overflow.  Which one is it?

[...]

Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature

[Luiz Capitulino]

On Tue, 16 Sep 2014 09:25:02 +0200
Markus Armbruster <armbru@redhat.com> wrote:

> Luiz Capitulino <lcapitulino@redhat.com> writes:
> 
> > When a QMP client changes the polling interval time by setting
> > the guest-stats-polling-interval property, the interval value
> > is stored and manipuled as an int64_t variable.
> >
> > However, the balloon_stats_change_timer() function, which is
> > used to set the actual timer with the interval value, takes
> > an int instead, causing an overflow for big interval values.
> >
> > Fix it.
> >
> > Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
> 
> Subject claims buffer overflow, but description suggests integer
> overflow.  Which one is it?

Integer.

Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature

[Markus Armbruster]

Luiz Capitulino <lcapitulino@redhat.com> writes:

> On Tue, 16 Sep 2014 09:25:02 +0200
> Markus Armbruster <armbru@redhat.com> wrote:
>
>> Luiz Capitulino <lcapitulino@redhat.com> writes:
>> 
>> > When a QMP client changes the polling interval time by setting
>> > the guest-stats-polling-interval property, the interval value
>> > is stored and manipuled as an int64_t variable.
>> >
>> > However, the balloon_stats_change_timer() function, which is
>> > used to set the actual timer with the interval value, takes
>> > an int instead, causing an overflow for big interval values.
>> >
>> > Fix it.
>> >
>> > Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
>> 
>> Subject claims buffer overflow, but description suggests integer
>> overflow.  Which one is it?
>
> Integer.

Thanks.  If you fix the subject, you can add my R-by.

Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature

[Luiz Capitulino]

On Tue, 16 Sep 2014 15:43:14 +0200
Markus Armbruster <armbru@redhat.com> wrote:

> Luiz Capitulino <lcapitulino@redhat.com> writes:
> 
> > On Tue, 16 Sep 2014 09:25:02 +0200
> > Markus Armbruster <armbru@redhat.com> wrote:
> >
> >> Luiz Capitulino <lcapitulino@redhat.com> writes:
> >> 
> >> > When a QMP client changes the polling interval time by setting
> >> > the guest-stats-polling-interval property, the interval value
> >> > is stored and manipuled as an int64_t variable.
> >> >
> >> > However, the balloon_stats_change_timer() function, which is
> >> > used to set the actual timer with the interval value, takes
> >> > an int instead, causing an overflow for big interval values.
> >> >
> >> > Fix it.
> >> >
> >> > Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
> >> 
> >> Subject claims buffer overflow, but description suggests integer
> >> overflow.  Which one is it?
> >
> > Integer.
> 
> Thanks.  If you fix the subject, you can add my R-by.

I've fixed the subject, but I've also added a new hunk to the patch.