Commit "kvm tools: virtio: remove hardcoded assumptions about guest page size" has introduced a bug that prevented guests with more than 4gb of ram from booting. The issue is that 'pfn' is a 32bit integer, so when multiplying it by page size to get the actual page will cause an overflow if the pfn referred to a memory area above 4gb. Signed-off-by: Sasha Levin <sasha.levin@xxxxxxxxxx> --- tools/kvm/virtio/9p.c | 2 +- tools/kvm/virtio/balloon.c | 2 +- tools/kvm/virtio/blk.c | 2 +- tools/kvm/virtio/console.c | 2 +- tools/kvm/virtio/net.c | 2 +- tools/kvm/virtio/rng.c | 2 +- tools/kvm/virtio/scsi.c | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tools/kvm/virtio/9p.c b/tools/kvm/virtio/9p.c index b7a5723..033b638 100644 --- a/tools/kvm/virtio/9p.c +++ b/tools/kvm/virtio/9p.c @@ -1267,7 +1267,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align, queue = &p9dev->vqs[vq]; queue->pfn = pfn; - p = guest_flat_to_host(kvm, queue->pfn * page_size); + p = guest_flat_to_host(kvm, (u64)queue->pfn * page_size); job = &p9dev->jobs[vq]; vring_init(&queue->vring, VIRTQUEUE_NUM, p, align); diff --git a/tools/kvm/virtio/balloon.c b/tools/kvm/virtio/balloon.c index d1b64fa..557ea25 100644 --- a/tools/kvm/virtio/balloon.c +++ b/tools/kvm/virtio/balloon.c @@ -204,7 +204,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align, queue = &bdev->vqs[vq]; queue->pfn = pfn; - p = guest_flat_to_host(kvm, queue->pfn * page_size); + p = guest_flat_to_host(kvm, (u64)queue->pfn * page_size); thread_pool__init_job(&bdev->jobs[vq], kvm, virtio_bln_do_io, queue); vring_init(&queue->vring, VIRTIO_BLN_QUEUE_SIZE, p, align); diff --git a/tools/kvm/virtio/blk.c b/tools/kvm/virtio/blk.c index 44ac44b..c977353 100644 --- a/tools/kvm/virtio/blk.c +++ b/tools/kvm/virtio/blk.c @@ -167,7 +167,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align, queue = &bdev->vqs[vq]; queue->pfn = pfn; - p = guest_flat_to_host(kvm, queue->pfn * page_size); + p = guest_flat_to_host(kvm, (u64)queue->pfn * page_size); vring_init(&queue->vring, VIRTIO_BLK_QUEUE_SIZE, p, align); diff --git a/tools/kvm/virtio/console.c b/tools/kvm/virtio/console.c index 1f88a4b..3ac4c9f 100644 --- a/tools/kvm/virtio/console.c +++ b/tools/kvm/virtio/console.c @@ -137,7 +137,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align, queue = &cdev.vqs[vq]; queue->pfn = pfn; - p = guest_flat_to_host(kvm, queue->pfn * page_size); + p = guest_flat_to_host(kvm, (u64)queue->pfn * page_size); vring_init(&queue->vring, VIRTIO_CONSOLE_QUEUE_SIZE, p, align); diff --git a/tools/kvm/virtio/net.c b/tools/kvm/virtio/net.c index 7855cfc..34a5f27 100644 --- a/tools/kvm/virtio/net.c +++ b/tools/kvm/virtio/net.c @@ -410,7 +410,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align, queue = &ndev->vqs[vq]; queue->pfn = pfn; - p = guest_flat_to_host(kvm, queue->pfn * page_size); + p = guest_flat_to_host(kvm, (u64)queue->pfn * page_size); vring_init(&queue->vring, VIRTIO_NET_QUEUE_SIZE, p, align); diff --git a/tools/kvm/virtio/rng.c b/tools/kvm/virtio/rng.c index 2ce8afd..d1754dc 100644 --- a/tools/kvm/virtio/rng.c +++ b/tools/kvm/virtio/rng.c @@ -98,7 +98,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align, queue = &rdev->vqs[vq]; queue->pfn = pfn; - p = guest_flat_to_host(kvm, queue->pfn * page_size); + p = guest_flat_to_host(kvm, (u64)queue->pfn * page_size); job = &rdev->jobs[vq]; diff --git a/tools/kvm/virtio/scsi.c b/tools/kvm/virtio/scsi.c index 05b2dc6..ad6320d 100644 --- a/tools/kvm/virtio/scsi.c +++ b/tools/kvm/virtio/scsi.c @@ -63,7 +63,7 @@ static int init_vq(struct kvm *kvm, void *dev, u32 vq, u32 page_size, u32 align, queue = &sdev->vqs[vq]; queue->pfn = pfn; - p = guest_flat_to_host(kvm, queue->pfn * page_size); + p = guest_flat_to_host(kvm, (u64)queue->pfn * page_size); vring_init(&queue->vring, VIRTIO_SCSI_QUEUE_SIZE, p, align); -- 1.8.1.2 -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
