[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 064/156] spapr_pci: Fix number of returned vectors i
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 064/156] spapr_pci: Fix number of returned vectors in ibm, change-msi |
Date: |
Tue, 8 Jul 2014 12:17:35 -0500 |
From: Alexey Kardashevskiy <address@hidden>
Current guest kernels try allocating as many vectors as the quota is.
For example, in the case of virtio-net (which has just 3 vectors)
the guest requests 4 vectors (that is the quota in the test) and
the existing ibm,change-msi handler returns 4. But before it returns,
it calls msix_set_message() in a loop and corrupts memory behind
the end of msix_table.
This limits the number of vectors returned by ibm,change-msi to
the maximum supported by the actual device.
Signed-off-by: Alexey Kardashevskiy <address@hidden>
Cc: address@hidden
[agraf: squash in bugfix from aik]
Signed-off-by: Alexander Graf <address@hidden>
(cherry picked from commit b26696b519f853c9844e5154858e583600ee3cdc)
*s/error_report/fprintf/ to reflect v1.7.x error reporting style
Signed-off-by: Michael Roth <address@hidden>
---
hw/ppc/spapr_pci.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index edb4cb0..0079d31 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -342,6 +342,22 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu,
sPAPREnvironment *spapr,
/* There is no cached config, allocate MSIs */
if (!phb->msi_table[ndev].nvec) {
+ int max_irqs = 0;
+ if (ret_intr_type == RTAS_TYPE_MSI) {
+ max_irqs = msi_nr_vectors_allocated(pdev);
+ } else if (ret_intr_type == RTAS_TYPE_MSIX) {
+ max_irqs = pdev->msix_entries_nr;
+ }
+ if (!max_irqs) {
+ fprintf(stderr,
+ "Requested interrupt type %d is not enabled for
device#%d\n",
+ ret_intr_type, ndev);
+ rtas_st(rets, 0, -1); /* Hardware error */
+ return;
+ }
+ if (req_num > max_irqs) {
+ req_num = max_irqs;
+ }
irq = spapr_allocate_irq_block(req_num, false,
ret_intr_type == RTAS_TYPE_MSI);
if (irq < 0) {
--
1.9.1
- [Qemu-devel] [PATCH 036/156] virtio-net: out-of-bounds buffer write on invalid state load, (continued)
- [Qemu-devel] [PATCH 036/156] virtio-net: out-of-bounds buffer write on invalid state load, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 042/156] pl022: fix buffer overun on invalid state load, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 046/156] openpic: avoid buffer overrun on incoming migration, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 041/156] hw/pci/pcie_aer.c: fix buffer overruns on invalid state load, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 054/156] vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 056/156] savevm: Ignore minimum_version_id_old if there is no load_state_old, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 055/156] usb: sanity check setup_index+setup_len in post_load, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 060/156] target-arm: Make vbar_write 64bit friendly on 32bit hosts, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 061/156] linux-user/elfload.c: Fix incorrect ARM HWCAP bits, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 062/156] linux-user/elfload.c: Update ARM HWCAP bits, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 064/156] spapr_pci: Fix number of returned vectors in ibm, change-msi,
Michael Roth <=
- [Qemu-devel] [PATCH 063/156] linux-user/elfload.c: Fix A64 code which was incorrectly acting like A32, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 065/156] pci-assign: limit # of msix vectors, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 074/156] block/cloop: refuse images with bogus offsets (CVE-2014-0144), Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 072/156] block/cloop: prevent offsets_size integer overflow (CVE-2014-0143), Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 075/156] block/cloop: fix offsets[] size off-by-one, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 079/156] bochs: Check catalog_size header field (CVE-2014-0143), Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 077/156] bochs: Unify header structs and make them QEMU_PACKED, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 076/156] qemu-iotests: Support for bochs format, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 052/156] zaurus: fix buffer overrun on invalid state load, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 086/156] curl: check data size before memcpy to local buffer. (CVE-2014-0144), Michael Roth, 2014/07/08