From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83B5EC07E99 for ; Mon, 12 Jul 2021 09:26:39 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id EDD386100B for ; Mon, 12 Jul 2021 09:26:38 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EDD386100B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:57026 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m2sD0-0006ca-3X for qemu-devel@archiver.kernel.org; Mon, 12 Jul 2021 05:26:38 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:57884) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m2sCK-0005xB-Ej for qemu-devel@nongnu.org; Mon, 12 Jul 2021 05:25:56 -0400 Received: from mail-io1-xd2d.google.com ([2607:f8b0:4864:20::d2d]:33778) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1m2sCI-0006fN-TL for qemu-devel@nongnu.org; Mon, 12 Jul 2021 05:25:56 -0400 Received: by mail-io1-xd2d.google.com with SMTP id 62so9843504iob.0 for ; Mon, 12 Jul 2021 02:25:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=O4+twl76yHpRe2vqVnwCiz+byWlOw0MacuFNAZwhTLY=; b=UTY0uqRWwyXsIMcVDNfJwW4CMs/c6SSPs+PtGLzzQtk8m8llPvQeHbjxQ/dLTT/XCO yawF7pvTiE15iX2yB7aCG8/2TF+QwBgcxlF11u5E5DvrkV1/7ZmCymNOjUkP8THfwEED IEr2o+w+kM4WwQgN93Lz7fh15x4ILx+B+snsOlEuzEjCvobEzvH8cV1gmHtG3cfsPSMR 7+lbLfObp1egCwYSNbIJ22By5ysKaiRRNpvq23SWb2nix2B3Mk5PfOG9rAld6cvhDbmo thdKIq2MsgUCqW5oXB5DA6Ln8dV5u3PMNqCqhCcFG9se7hqRvbnhDQPu4fx0cf1RkFWD QYvw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=O4+twl76yHpRe2vqVnwCiz+byWlOw0MacuFNAZwhTLY=; b=AdCsdcv+/2mgtc4Jn0j06ETBtDBq4l+TRluoLA2vLbPoJuEqtNt4bHXuTffkbY5FRh gkd9RhYeEYSBRj/GU4WsIijEvDxMQIg0p6x0T5TQfhg7cA7AJRYqpQOFgP5sqRbpStZC 19M8BuZrWfMxH0/rDsMVi41b5Ge0AJE+FojEBnaQ9sBL/OMyfRs4XZUJElm/uyA/tAkr zsQTYxl4CRetGGlx+OzVJhrA9ZMXo6jSEbUxY3aI9Dz7ZI5tfx5oUdAbvHbqC9gpQn4T VNN5HhLlo3OgimlYNGL8uaZuNsXlCal5R78E9uQhWQM+D3riMdiD+sRTKZprq7ZgV/Eg r+Kw== X-Gm-Message-State: AOAM530WSCejedRnUaIJr2VdRdSwfU2KnJ2eX5WMHMMiZo8aGAjwn5WT 4bCzhwvzJX+YGhv56SRZvxfzI70kjEVpexr8J64= X-Google-Smtp-Source: ABdhPJzBY1JWcmAWOtAtaXp2IHLO0hv2jdlDtOab9XssKfsqyiOgJZ/cSUK8ZvOWEnlZ8B6zD7m/RXAmC57vvn2EdCs= X-Received: by 2002:a5d:9cd9:: with SMTP id w25mr26954783iow.36.1626081953346; Mon, 12 Jul 2021 02:25:53 -0700 (PDT) MIME-Version: 1.0 References: <20210712083135.15755-1-david@redhat.com> In-Reply-To: <20210712083135.15755-1-david@redhat.com> From: Pankaj Gupta Date: Mon, 12 Jul 2021 11:25:42 +0200 Message-ID: Subject: Re: [PATCH v1] vfio: Fix CID 1458134 in vfio_register_ram_discard_listener() To: David Hildenbrand Content-Type: text/plain; charset="UTF-8" Received-SPF: pass client-ip=2607:f8b0:4864:20::d2d; envelope-from=pankaj.gupta.linux@gmail.com; helo=mail-io1-xd2d.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Eduardo Habkost , "Michael S. Tsirkin" , Qemu Developers , Peter Xu , "Dr . David Alan Gilbert" , Auger Eric , Alex Williamson , teawater , Igor Mammedov , Paolo Bonzini , Marek Kedzierski , Wei Yang Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" > CID 1458134: Integer handling issues (BAD_SHIFT) > In expression "1 << ctz64(container->pgsizes)", left shifting by more > than 31 bits has undefined behavior. The shift amount, > "ctz64(container->pgsizes)", is 64. > > Commit 5e3b981c330c ("vfio: Support for RamDiscardManager in the !vIOMMU > case") added an assertion that our granularity is at least as big as the > page size. > > Although unlikely, we could have a page size that does not fit into > 32 bit. In that case, we'd try shifting by more than 31 bit. > > Let's use 1ULL instead and make sure we're not shifting by more than 63 > bit by asserting that any bit in container->pgsizes is set. > > Fixes: CID 1458134 > Cc: Alex Williamson > Cc: Eduardo Habkost > Cc: "Michael S. Tsirkin" > Cc: Paolo Bonzini > Cc: Dr. David Alan Gilbert > Cc: Igor Mammedov > Cc: Pankaj Gupta > Cc: Peter Xu > Cc: Auger Eric > Cc: Wei Yang > Cc: teawater > Cc: Marek Kedzierski > Signed-off-by: David Hildenbrand > --- > hw/vfio/common.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/hw/vfio/common.c b/hw/vfio/common.c > index 3f0d111360..8728d4d5c2 100644 > --- a/hw/vfio/common.c > +++ b/hw/vfio/common.c > @@ -783,7 +783,8 @@ static void vfio_register_ram_discard_listener(VFIOContainer *container, > section->mr); > > g_assert(vrdl->granularity && is_power_of_2(vrdl->granularity)); > - g_assert(vrdl->granularity >= 1 << ctz64(container->pgsizes)); > + g_assert(container->pgsizes && > + vrdl->granularity >= 1ULL << ctz64(container->pgsizes)); > > ram_discard_listener_init(&vrdl->listener, > vfio_ram_discard_notify_populate, > Fixes: d5015b801340 ("softmmu/memory: Pass ram_flags to > qemu_ram_alloc_from_fd()") > > Signed-off-by: Yang Zhong > Reviewed-by: David Hildenbrand > --- > hw/remote/memory.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/remote/memory.c b/hw/remote/memory.c > index 472ed2a272..6e21ab1a45 100644 > --- a/hw/remote/memory.c > +++ b/hw/remote/memory.c > @@ -46,7 +46,7 @@ void remote_sysmem_reconfig(MPQemuMsg *msg, Error **errp) > subregion = g_new(MemoryRegion, 1); > memory_region_init_ram_from_fd(subregion, NULL, > name, sysmem_info->sizes[region], > - true, msg->fds[region], > + RAM_SHARED, msg->fds[region], > sysmem_info->offsets[region], > errp); > Reviewed-by: Pankaj Gupta