mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ppc/xive: Fix ESB length overflow on 32-bit hosts

Browse Source 
The length of this region can be > 32-bits, which overflows size_t on
32-bit hosts. Change to uint64_t.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
(cherry picked from commit 07f2770503)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
Nicholas Piggin 2024-11-04 02:09:12 +10:00 committed by Michael Tokarev
parent 3213428964
commit a6df2164fe
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hw/intc/spapr_xive_kvm.c
View File

@ -720,7 +720,7 @@ int kvmppc_xive_connect(SpaprInterruptController *intc, uint32_t nr_servers,
{
SpaprXive *xive = SPAPR_XIVE(intc);
XiveSource *xsrc = &xive->source;
size_t esb_len = xive_source_esb_len(xsrc);
uint64_t esb_len = xive_source_esb_len(xsrc);
size_t tima_len = 4ull << TM_SHIFT;
CPUState *cs;
int fd;
@ -824,7 +824,7 @@ void kvmppc_xive_disconnect(SpaprInterruptController *intc)
{
SpaprXive *xive = SPAPR_XIVE(intc);
XiveSource *xsrc;
size_t esb_len;
uint64_t esb_len;
assert(xive->fd != -1);

2
hw/intc/xive.c
View File

@ -1238,7 +1238,7 @@ static void xive_source_reset(void *dev)
static void xive_source_realize(DeviceState *dev, Error **errp)
{
XiveSource *xsrc = XIVE_SOURCE(dev);
size_t esb_len = xive_source_esb_len(xsrc);
uint64_t esb_len = xive_source_esb_len(xsrc);
assert(xsrc->xive);

2
include/hw/ppc/xive.h
View File

@ -218,7 +218,7 @@ static inline bool xive_source_esb_has_2page(XiveSource *xsrc)
xsrc->esb_shift == XIVE_ESB_4K_2PAGE;
}
static inline size_t xive_source_esb_len(XiveSource *xsrc)
static inline uint64_t xive_source_esb_len(XiveSource *xsrc)
{
return (1ull << xsrc->esb_shift) * xsrc->nr_irqs;
}