From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38080) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9CGN-000506-3m for qemu-devel@nongnu.org; Thu, 08 Jan 2015 07:32:31 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y9CGJ-0008GX-3v for qemu-devel@nongnu.org; Thu, 08 Jan 2015 07:32:31 -0500 Received: from mail-pa0-f46.google.com ([209.85.220.46]:39863) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9CGI-0008GR-UA for qemu-devel@nongnu.org; Thu, 08 Jan 2015 07:32:27 -0500 Received: by mail-pa0-f46.google.com with SMTP id lf10so11544546pab.5 for ; Thu, 08 Jan 2015 04:32:25 -0800 (PST) Message-ID: <54AE78D4.8060800@ozlabs.ru> Date: Thu, 08 Jan 2015 23:32:20 +1100 From: Alexey Kardashevskiy MIME-Version: 1.0 References: <20150107172040.29974.56600.stgit@gimli.home> In-Reply-To: <20150107172040.29974.56600.stgit@gimli.home> Content-Type: text/plain; charset=koi8-r Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH v2] vfio-pci: Fix BAR size overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Alex Williamson , qemu-devel@nongnu.org On 01/08/2015 04:23 AM, Alex Williamson wrote: > We use an unsigned int when working with the PCI BAR size, which can > obviously overflow if the BAR is 4GB or larger. This needs to change > to a fixed length uint64_t. A similar issue is possible, though even > more unlikely, when mapping the region above an MSI-X table. The > start of the MSI-X vector table must be below 4GB, but the end, and > therefore the start of the next mapping region, could still land at > 4GB. > > Suggested-by: Nishank Trivedi > Signed-off-by: Alex Williamson Tested-by: Alexey Kardashevskiy Helped me with 16GB BARs. > --- > > v2: s/unsigned long/uint64_t/, duh > > hw/vfio/pci.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c > index b4e73d1..b6703c7 100644 > --- a/hw/vfio/pci.c > +++ b/hw/vfio/pci.c > @@ -2301,7 +2301,7 @@ static void vfio_unmap_bar(VFIOPCIDevice *vdev, int nr) > static void vfio_map_bar(VFIOPCIDevice *vdev, int nr) > { > VFIOBAR *bar = &vdev->bars[nr]; > - unsigned size = bar->region.size; > + uint64_t size = bar->region.size; > char name[64]; > uint32_t pci_bar; > uint8_t type; > @@ -2351,7 +2351,7 @@ static void vfio_map_bar(VFIOPCIDevice *vdev, int nr) > } > > if (vdev->msix && vdev->msix->table_bar == nr) { > - unsigned start; > + uint64_t start; > > start = HOST_PAGE_ALIGN(vdev->msix->table_offset + > (vdev->msix->entries * PCI_MSIX_ENTRY_SIZE)); > > -- Alexey