yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
5d360b
From 7f476950b0f5780d1112f8e9d0d92ece55ae6912 Mon Sep 17 00:00:00 2001
5d360b
From: Richard Jones <rjones@redhat.com>
5d360b
Date: Wed, 1 Nov 2017 11:33:00 +0100
5d360b
Subject: [PATCH 5/7] i6300esb: Fix signed integer overflow
5d360b
5d360b
RH-Author: Richard Jones <rjones@redhat.com>
5d360b
Message-id: <1509535982-27927-2-git-send-email-rjones@redhat.com>
5d360b
Patchwork-id: 77461
5d360b
O-Subject: [RHEL-7.5 qemu-kvm PATCH v3 1/3] i6300esb: Fix signed integer overflow
5d360b
Bugzilla: 1470244
5d360b
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
5d360b
RH-Acked-by: Thomas Huth <thuth@redhat.com>
5d360b
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
5d360b
5d360b
From: David Gibson <david@gibson.dropbear.id.au>
5d360b
5d360b
If the guest programs a sufficiently large timeout value an integer
5d360b
overflow can occur in i6300esb_restart_timer().  e.g. if the maximum
5d360b
possible timer preload value of 0xfffff is programmed then we end up with
5d360b
the calculation:
5d360b
5d360b
timeout = get_ticks_per_sec() * (0xfffff << 15) / 33000000;
5d360b
5d360b
get_ticks_per_sec() returns 1000000000 (10^9) giving:
5d360b
5d360b
     10^9 * (0xfffff * 2^15) == 0x1dcd632329b000000 (65 bits)
5d360b
5d360b
Obviously the division by 33MHz brings it back under 64-bits, but the
5d360b
overflow has already occurred.
5d360b
5d360b
Since signed integer overflow has undefined behaviour in C, in theory this
5d360b
could be arbitrarily bad.  In practice, the overflowed value wraps around
5d360b
to something negative, causing the watchdog to immediately expire, killing
5d360b
the guest, which is still fairly bad.
5d360b
5d360b
The bug can be triggered by running a Linux guest, loading the i6300esb
5d360b
driver with parameter "heartbeat=2046" and opening /dev/watchdog.  The
5d360b
watchdog will trigger as soon as the device is opened.
5d360b
5d360b
This patch corrects the problem by using muldiv64(), which effectively
5d360b
allows a 128-bit intermediate value between the multiplication and
5d360b
division.
5d360b
5d360b
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
5d360b
Message-Id: <1427075508-12099-3-git-send-email-david@gibson.dropbear.id.au>
5d360b
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
5d360b
(cherry picked from commit 4bc7b4d56657ebf75b986ad46e959cf7232ff26a)
5d360b
5d360b
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1470244
5d360b
Upstream-status: 4bc7b4d56657ebf75b986ad46e959cf7232ff26a
5d360b
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
5d360b
---
5d360b
 hw/watchdog/wdt_i6300esb.c | 10 ++++++++--
5d360b
 1 file changed, 8 insertions(+), 2 deletions(-)
5d360b
5d360b
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
5d360b
index a2ace52..be35034 100644
5d360b
--- a/hw/watchdog/wdt_i6300esb.c
5d360b
+++ b/hw/watchdog/wdt_i6300esb.c
5d360b
@@ -125,8 +125,14 @@ static void i6300esb_restart_timer(I6300State *d, int stage)
5d360b
     else
5d360b
         timeout <<= 5;
5d360b
 
5d360b
-    /* Get the timeout in units of ticks_per_sec. */
5d360b
-    timeout = get_ticks_per_sec() * timeout / 33000000;
5d360b
+    /* Get the timeout in units of ticks_per_sec.
5d360b
+     *
5d360b
+     * ticks_per_sec is typically 10^9 == 0x3B9ACA00 (30 bits), with
5d360b
+     * 20 bits of user supplied preload, and 15 bits of scale, the
5d360b
+     * multiply here can exceed 64-bits, before we divide by 33MHz, so
5d360b
+     * we use a higher-precision intermediate result.
5d360b
+     */
5d360b
+    timeout = muldiv64(get_ticks_per_sec(), timeout, 33000000);
5d360b
 
5d360b
     i6300esb_debug("stage %d, timeout %" PRIi64 "\n", d->stage, timeout);
5d360b
 
5d360b
-- 
5d360b
1.8.3.1
5d360b