queue->pfn may be used to point at addresses larger than 32 bit. Prevent a wraparound when shifting it left. Signed-off-by: Sasha Levin <levinsasha928@xxxxxxxxx> --- tools/kvm/virtio/blk.c | 2 +- tools/kvm/virtio/console.c | 2 +- tools/kvm/virtio/net.c | 2 +- tools/kvm/virtio/rng.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/kvm/virtio/blk.c b/tools/kvm/virtio/blk.c index 12c7029..b7fea79 100644 --- a/tools/kvm/virtio/blk.c +++ b/tools/kvm/virtio/blk.c @@ -197,7 +197,7 @@ static bool virtio_blk_pci_io_out(struct kvm *self, u16 port, void *data, int si queue = &bdev->vqs[bdev->queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_flat_to_host(self, (u64)queue->pfn << 12); vring_init(&queue->vring, VIRTIO_BLK_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/console.c b/tools/kvm/virtio/console.c index f9031cb..7a5bc89 100644 --- a/tools/kvm/virtio/console.c +++ b/tools/kvm/virtio/console.c @@ -199,7 +199,7 @@ static bool virtio_console_pci_io_out(struct kvm *self, u16 port, void *data, in queue = &cdev.vqs[cdev.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_flat_to_host(self, (u64)queue->pfn << 12); vring_init(&queue->vring, VIRTIO_CONSOLE_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/net.c b/tools/kvm/virtio/net.c index 8d430e3..13caba2 100644 --- a/tools/kvm/virtio/net.c +++ b/tools/kvm/virtio/net.c @@ -245,7 +245,7 @@ static bool virtio_net_pci_io_out(struct kvm *self, u16 port, void *data, int si queue = &net_device.vqs[net_device.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(self, queue->pfn << 12); + p = guest_flat_to_host(self, (u64)queue->pfn << 12); vring_init(&queue->vring, VIRTIO_NET_QUEUE_SIZE, p, 4096); diff --git a/tools/kvm/virtio/rng.c b/tools/kvm/virtio/rng.c index f692dfd..60baa8e 100644 --- a/tools/kvm/virtio/rng.c +++ b/tools/kvm/virtio/rng.c @@ -129,7 +129,7 @@ static bool virtio_rng_pci_io_out(struct kvm *kvm, u16 port, void *data, int siz queue = &rdev.vqs[rdev.queue_selector]; queue->pfn = ioport__read32(data); - p = guest_flat_to_host(kvm, queue->pfn << 12); + p = guest_flat_to_host(kvm, (u64)queue->pfn << 12); vring_init(&queue->vring, VIRTIO_RNG_QUEUE_SIZE, p, 4096); -- 1.7.5.rc3 -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
