* [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature
@ 2014-09-15 18:09 Luiz Capitulino
2014-09-15 19:16 ` Eric Blake
2014-09-16 7:25 ` Markus Armbruster
0 siblings, 2 replies; 7+ messages in thread
From: Luiz Capitulino @ 2014-09-15 18:09 UTC (permalink / raw)
To: qemu-devel; +Cc: qemu-stable
When a QMP client changes the polling interval time by setting
the guest-stats-polling-interval property, the interval value
is stored and manipuled as an int64_t variable.
However, the balloon_stats_change_timer() function, which is
used to set the actual timer with the interval value, takes
an int instead, causing an overflow for big interval values.
Fix it.
Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
---
hw/virtio/virtio-balloon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 2c30b3d..9629264 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s)
}
}
-static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
+static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
{
timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
}
--
1.9.3
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature
2014-09-15 18:09 [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature Luiz Capitulino
@ 2014-09-15 19:16 ` Eric Blake
2014-09-15 19:33 ` Luiz Capitulino
2014-09-16 7:25 ` Markus Armbruster
1 sibling, 1 reply; 7+ messages in thread
From: Eric Blake @ 2014-09-15 19:16 UTC (permalink / raw)
To: Luiz Capitulino, qemu-devel; +Cc: qemu-stable
[-- Attachment #1: Type: text/plain, Size: 1345 bytes --]
On 09/15/2014 12:09 PM, Luiz Capitulino wrote:
> When a QMP client changes the polling interval time by setting
> the guest-stats-polling-interval property, the interval value
> is stored and manipuled as an int64_t variable.
>
s/manipuled/manipulated/
> However, the balloon_stats_change_timer() function, which is
> used to set the actual timer with the interval value, takes
> an int instead, causing an overflow for big interval values.
>
> Fix it.
>
> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
> ---
> hw/virtio/virtio-balloon.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> index 2c30b3d..9629264 100644
> --- a/hw/virtio/virtio-balloon.c
> +++ b/hw/virtio/virtio-balloon.c
> @@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s)
> }
> }
>
> -static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
> +static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
> {
> timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
secs * 1000 can still overflow for (really large) values, do we care
about that?
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 539 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature
2014-09-15 19:16 ` Eric Blake
@ 2014-09-15 19:33 ` Luiz Capitulino
0 siblings, 0 replies; 7+ messages in thread
From: Luiz Capitulino @ 2014-09-15 19:33 UTC (permalink / raw)
To: Eric Blake; +Cc: qemu-devel, qemu-stable
On Mon, 15 Sep 2014 13:16:01 -0600
Eric Blake <eblake@redhat.com> wrote:
> On 09/15/2014 12:09 PM, Luiz Capitulino wrote:
> > When a QMP client changes the polling interval time by setting
> > the guest-stats-polling-interval property, the interval value
> > is stored and manipuled as an int64_t variable.
> >
>
> s/manipuled/manipulated/
>
> > However, the balloon_stats_change_timer() function, which is
> > used to set the actual timer with the interval value, takes
> > an int instead, causing an overflow for big interval values.
> >
> > Fix it.
> >
> > Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
> > ---
> > hw/virtio/virtio-balloon.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
> > index 2c30b3d..9629264 100644
> > --- a/hw/virtio/virtio-balloon.c
> > +++ b/hw/virtio/virtio-balloon.c
> > @@ -87,7 +87,7 @@ static void balloon_stats_destroy_timer(VirtIOBalloon *s)
> > }
> > }
> >
> > -static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
> > +static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
> > {
> > timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
>
> secs * 1000 can still overflow for (really large) values, do we care
> about that?
Hmm, good point. I think I could keep the s/int/int64_t change but limit secs
to UINT_MAX for simplicity. I guess we don't expect anyone to set this to
billions of seconds in the future :)
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature
2014-09-15 18:09 [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature Luiz Capitulino
2014-09-15 19:16 ` Eric Blake
@ 2014-09-16 7:25 ` Markus Armbruster
2014-09-16 12:34 ` Luiz Capitulino
1 sibling, 1 reply; 7+ messages in thread
From: Markus Armbruster @ 2014-09-16 7:25 UTC (permalink / raw)
To: Luiz Capitulino; +Cc: qemu-devel, qemu-stable
Luiz Capitulino <lcapitulino@redhat.com> writes:
> When a QMP client changes the polling interval time by setting
> the guest-stats-polling-interval property, the interval value
> is stored and manipuled as an int64_t variable.
>
> However, the balloon_stats_change_timer() function, which is
> used to set the actual timer with the interval value, takes
> an int instead, causing an overflow for big interval values.
>
> Fix it.
>
> Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
Subject claims buffer overflow, but description suggests integer
overflow. Which one is it?
[...]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature
2014-09-16 7:25 ` Markus Armbruster
@ 2014-09-16 12:34 ` Luiz Capitulino
2014-09-16 13:43 ` Markus Armbruster
0 siblings, 1 reply; 7+ messages in thread
From: Luiz Capitulino @ 2014-09-16 12:34 UTC (permalink / raw)
To: Markus Armbruster; +Cc: qemu-devel, qemu-stable
On Tue, 16 Sep 2014 09:25:02 +0200
Markus Armbruster <armbru@redhat.com> wrote:
> Luiz Capitulino <lcapitulino@redhat.com> writes:
>
> > When a QMP client changes the polling interval time by setting
> > the guest-stats-polling-interval property, the interval value
> > is stored and manipuled as an int64_t variable.
> >
> > However, the balloon_stats_change_timer() function, which is
> > used to set the actual timer with the interval value, takes
> > an int instead, causing an overflow for big interval values.
> >
> > Fix it.
> >
> > Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
>
> Subject claims buffer overflow, but description suggests integer
> overflow. Which one is it?
Integer.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature
2014-09-16 12:34 ` Luiz Capitulino
@ 2014-09-16 13:43 ` Markus Armbruster
2014-09-16 13:44 ` Luiz Capitulino
0 siblings, 1 reply; 7+ messages in thread
From: Markus Armbruster @ 2014-09-16 13:43 UTC (permalink / raw)
To: Luiz Capitulino; +Cc: qemu-devel, qemu-stable
Luiz Capitulino <lcapitulino@redhat.com> writes:
> On Tue, 16 Sep 2014 09:25:02 +0200
> Markus Armbruster <armbru@redhat.com> wrote:
>
>> Luiz Capitulino <lcapitulino@redhat.com> writes:
>>
>> > When a QMP client changes the polling interval time by setting
>> > the guest-stats-polling-interval property, the interval value
>> > is stored and manipuled as an int64_t variable.
>> >
>> > However, the balloon_stats_change_timer() function, which is
>> > used to set the actual timer with the interval value, takes
>> > an int instead, causing an overflow for big interval values.
>> >
>> > Fix it.
>> >
>> > Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
>>
>> Subject claims buffer overflow, but description suggests integer
>> overflow. Which one is it?
>
> Integer.
Thanks. If you fix the subject, you can add my R-by.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature
2014-09-16 13:43 ` Markus Armbruster
@ 2014-09-16 13:44 ` Luiz Capitulino
0 siblings, 0 replies; 7+ messages in thread
From: Luiz Capitulino @ 2014-09-16 13:44 UTC (permalink / raw)
To: Markus Armbruster; +Cc: qemu-devel, qemu-stable
On Tue, 16 Sep 2014 15:43:14 +0200
Markus Armbruster <armbru@redhat.com> wrote:
> Luiz Capitulino <lcapitulino@redhat.com> writes:
>
> > On Tue, 16 Sep 2014 09:25:02 +0200
> > Markus Armbruster <armbru@redhat.com> wrote:
> >
> >> Luiz Capitulino <lcapitulino@redhat.com> writes:
> >>
> >> > When a QMP client changes the polling interval time by setting
> >> > the guest-stats-polling-interval property, the interval value
> >> > is stored and manipuled as an int64_t variable.
> >> >
> >> > However, the balloon_stats_change_timer() function, which is
> >> > used to set the actual timer with the interval value, takes
> >> > an int instead, causing an overflow for big interval values.
> >> >
> >> > Fix it.
> >> >
> >> > Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
> >>
> >> Subject claims buffer overflow, but description suggests integer
> >> overflow. Which one is it?
> >
> > Integer.
>
> Thanks. If you fix the subject, you can add my R-by.
I've fixed the subject, but I've also added a new hunk to the patch.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2014-09-16 13:44 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-09-15 18:09 [Qemu-devel] [PATCH] virtio-balloon: fix buffer overflow in memory stats feature Luiz Capitulino
2014-09-15 19:16 ` Eric Blake
2014-09-15 19:33 ` Luiz Capitulino
2014-09-16 7:25 ` Markus Armbruster
2014-09-16 12:34 ` Luiz Capitulino
2014-09-16 13:43 ` Markus Armbruster
2014-09-16 13:44 ` Luiz Capitulino
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.