[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 28/38] ivshmem: Tighten check of property "size"
From: |
Markus Armbruster |
Subject: |
[Qemu-devel] [PATCH 28/38] ivshmem: Tighten check of property "size" |
Date: |
Mon, 29 Feb 2016 19:40:44 +0100 |
If size_t is narrower than 64 bits, passing uint64_t ivshmem_size to
mmap() truncates. Reject such sizes.
Signed-off-by: Markus Armbruster <address@hidden>
---
hw/misc/ivshmem.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index fb8a4f7..8d54fa9 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -87,7 +87,7 @@ typedef struct IVShmemState {
*/
MemoryRegion bar;
MemoryRegion ivshmem;
- uint64_t ivshmem_size; /* size of shared memory region */
+ size_t ivshmem_size; /* size of shared memory region */
uint32_t ivshmem_64bit;
Peer *peers;
@@ -361,7 +361,7 @@ static int check_shm_size(IVShmemState *s, int fd, Error
**errp)
if (s->ivshmem_size > buf.st_size) {
error_setg(errp, "Requested memory size greater"
- " than shared object size (%" PRIu64 " > %" PRIu64")",
+ " than shared object size (%zu > %" PRIu64")",
s->ivshmem_size, (uint64_t)buf.st_size);
return -1;
} else {
@@ -861,7 +861,8 @@ static void pci_ivshmem_realize(PCIDevice *dev, Error
**errp)
} else {
char *end;
int64_t size = qemu_strtosz(s->sizearg, &end);
- if (size < 0 || *end != '\0' || !is_power_of_2(size)) {
+ if (size < 0 || (size_t)size != size || *end != '\0'
+ || !is_power_of_2(size)) {
error_setg(errp, "Invalid size %s", s->sizearg);
return;
}
--
2.4.3
- [Qemu-devel] [PATCH 10/38] ivshmem: Compile debug prints unconditionally to prevent bit-rot, (continued)
- [Qemu-devel] [PATCH 10/38] ivshmem: Compile debug prints unconditionally to prevent bit-rot, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 22/38] ivshmem: Plug leaks on unplug, fix peer disconnect, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 06/38] ivshmem-test: Clean up wait for devices to become operational, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 16/38] ivshmem: Clean up register callbacks, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 03/38] event_notifier: Make event_notifier_init_fd() #ifdef CONFIG_EVENTFD, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 13/38] ivshmem: Don't destroy the chardev on version mismatch, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 21/38] ivshmem: Disentangle ivshmem_read(), Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 32/38] qdev: New DEFINE_PROP_ON_OFF_AUTO, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 26/38] ivshmem: Drop the hackish test for UNIX domain chardev, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 19/38] ivshmem: Assert interrupts are set up once, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 28/38] ivshmem: Tighten check of property "size",
Markus Armbruster <=
- [Qemu-devel] [PATCH 30/38] ivshmem: Simplify memory regions for BAR 2 (shared memory), Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 38/38] contrib/ivshmem-server: Print "not for production" warning, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 25/38] ivshmem: Rely on server sending the ID right after the version, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 04/38] tests/libqos/pci-pc: Fix qpci_pc_iomap() to map BARs aligned, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 08/38] ivshmem: Rewrite specification document, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 37/38] ivshmem: Require master to have ID zero, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 36/38] ivshmem: Drop ivshmem property x-memdev, Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 24/38] ivshmem: Propagate errors through ivshmem_recv_setup(), Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 23/38] ivshmem: Receive shared memory synchronously in realize(), Markus Armbruster, 2016/02/29
- [Qemu-devel] [PATCH 18/38] ivshmem: Leave INTx alone when using MSI-X, Markus Armbruster, 2016/02/29