[Qemu-devel] [PATCH] target-i386: avoid overflow in the tsc-frequency property

[Qemu-devel] [PATCH] target-i386: avoid overflow in the tsc-frequency property

[Paolo Bonzini]

The TSC frequency fits comfortably in an int when expressed in kHz,
but it may overflow when converted to Hz.  In this case,
tsc-frequency returns a negative value because x86_cpuid_get_tsc_freq
does a 32-bit multiplication before assigning to int64_t.

For simplicity just make tsc_khz a 64-bit value.

Spotted by Coverity.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target-i386/cpu.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target-i386/cpu.h b/target-i386/cpu.h
index 603aaf0..2125049 100644
--- a/target-i386/cpu.h
+++ b/target-i386/cpu.h
@@ -958,7 +958,7 @@ typedef struct CPUX86State {
     uint8_t has_error_code;
     uint32_t sipi_vector;
     bool tsc_valid;
-    int tsc_khz;
+    int64_t tsc_khz;
     void *kvm_xsave_buf;
 
     uint64_t mcg_cap;
-- 
2.4.3

Re: [Qemu-devel] [PATCH] target-i386: avoid overflow in the tsc-frequency property

[Eduardo Habkost]

On Wed, Jun 24, 2015 at 02:11:27PM +0200, Paolo Bonzini wrote:
> The TSC frequency fits comfortably in an int when expressed in kHz,
> but it may overflow when converted to Hz.  In this case,
> tsc-frequency returns a negative value because x86_cpuid_get_tsc_freq
> does a 32-bit multiplication before assigning to int64_t.
> 
> For simplicity just make tsc_khz a 64-bit value.
> 
> Spotted by Coverity.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>

Applied to the x86 tree. Thanks!

-- 
Eduardo