[Qemu-devel] [PATCH] Make page_find() return 0 for too-large addresses

[Eduardo Habkost]

On some cases, such as under KVM, tb_invalidate_phys_page_range()
may be called for large addresses, when qemu is configured to more than
4GB of RAM.

On these cases, qemu was crashing because it was using an index too
large for l1_map[], that supports only 32-bit addresses when compiling
without CONFIG_USER_ONLY.

Below is a sample backtrace of this happening, under KVM. 'start' on
tb_invalidate_phys_page_range() is 0x132b1c812, beyond 2^32, making
page_find() return a bogus pointer.

 #0  tb_invalidate_phys_page_range (start=5145479186, end=5145479246, 
is_cpu_write_access=0) at /usr/src/debug/kvm-74/qemu/exec.c:877
 #1  0x000000000049cd28 in cpu_physical_memory_rw (addr=5682350098, 
buf=0x7389dd10 "RT", len=60, is_write=1) at 
/usr/src/debug/kvm-74/qemu/exec.c:2818
 #2  0x0000000000428f54 in rtl8139_do_receive (opaque=0x1f472240, buf=<value 
optimized out>, size=60, do_interrupt=1) at ../cpu-all.h:929
 #3  0x000000000040717b in qemu_send_packet (vc1=0x1e54f480, buf=0x7389ddc0 
"RT", size=42) at /usr/src/debug/kvm-74/qemu/vl.c:4146
 #4  0x0000000000480990 in slirp_input (pkt=0x1f4a9010 "������RT", pkt_len=42) 
at slirp/slirp.c:597
 #5  0x000000000040717b in qemu_send_packet (vc1=0x1f475d70, buf=0x1f4a9010 
"������RT", size=42) at /usr/src/debug/kvm-74/qemu/vl.c:4146
 #6  0x00000000004295bd in rtl8139_io_writeb (opaque=0x1f472240, addr=<value 
optimized out>, val=<value optimized out>) at 
/usr/src/debug/kvm-74/qemu/hw/rtl8139.c:2299
 #7  0x000000000049cb62 in cpu_physical_memory_rw (addr=4060090585, 
buf=0x2aaadcf11028 <Address 0x2aaadcf11028 out of bounds>, len=1, is_write=1)
     at /usr/src/debug/kvm-74/qemu/exec.c:2807
 #8  0x00000000004eebf8 in kvm_mmio_write (opaque=<value optimized out>, 
addr=5145479186, data=0x132b1c84e <Address 0x132b1c84e out of bounds>, 
len=707232)
     at /usr/src/debug/kvm-74/qemu/qemu-kvm.c:689
 #9  0x0000000000515646 in handle_mmio (kvm=0x1e54e040, kvm_run=0x2aaadcf11000) 
at libkvm.c:849
 #10 0x0000000000515b57 in kvm_run (kvm=0x1e54e040, vcpu=0) at libkvm.c:975


The following patch makes page_find() safe for >32-bit addresses, by
just returning 0 if the address is too large.

The translation block handling code on exec.c still doesn't support
addresses >32-bit if CONFIG_USER_ONLY is not defined (KVM qemu currently
crashes immediately when using -no-kvm with more than 4 GB of memory),
but this is another issue.


Signed-off-by: Eduardo Habkost <address@hidden>
---
diff -purN qemu.orig/exec.c qemu/exec.c
--- qemu.orig/exec.c    2008-09-12 15:40:37.000000000 -0300
+++ qemu/exec.c 2008-09-12 15:40:37.000000000 -0300
@@ -317,8 +317,11 @@ static inline PageDesc *page_find_alloc(
 static inline PageDesc *page_find(target_ulong index)
 {
     PageDesc *p;
+    target_ulong l1_index = (index >> L2_BITS);
+    if (l1_index > L1_SIZE)
+        return 0;
 
-    p = l1_map[index >> L2_BITS];
+    p = l1_map[l1_index];
     if (!p)
         return 0;
     return p + (index & (L2_SIZE - 1));


-- 
Eduardo