rpms/kvm/devel kvm-74-page-find.patch,NONE,1.1 kvm.spec,1.70,1.71

[Glauber Costa]

Author: glommer

Update of /cvs/pkgs/rpms/kvm/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv20685

Modified Files:
	kvm.spec 
Added Files:
	kvm-74-page-find.patch 
Log Message:
fix page_find out of bounds access - #462380



kvm-74-page-find.patch:

--- NEW FILE kvm-74-page-find.patch ---
commit 434929bf11f0573d953c24287badbc2431a042ef
Author: aliguori <aliguori at c046a42c-6fe2-441c-8c8c-71466251a162>
Date:   Mon Sep 15 15:56:30 2008 +0000

    Make page_find() return 0 for too-large addresses (Eduardo Habkost)
    
    On some cases, such as under KVM, tb_invalidate_phys_page_range()
    may be called for large addresses, when qemu is configured to more than
    4GB of RAM.
    
    On these cases, qemu was crashing because it was using an index too
    large for l1_map[], that supports only 32-bit addresses when compiling
    without CONFIG_USER_ONLY.
    
    Signed-off-by: Eduardo Habkost <ehabkost at redhat.com>
    Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>
    
    
    
    git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5227 c046a42c-6fe2-441c-8c8c-71466251a162

Index: kvm-74/qemu/exec.c
===================================================================
--- kvm-74.orig/qemu/exec.c
+++ kvm-74/qemu/exec.c
@@ -286,17 +286,24 @@ static void page_init(void)
 #endif
 }
 
-static inline PageDesc *page_find_alloc(target_ulong index)
+static inline PageDesc **page_l1_map(target_ulong index)
 {
-    PageDesc **lp, *p;
-
 #if TARGET_LONG_BITS > 32
     /* Host memory outside guest VM.  For 32-bit targets we have already
        excluded high addresses.  */
     if (index > ((target_ulong)L2_SIZE * L1_SIZE * TARGET_PAGE_SIZE))
         return NULL;
 #endif
-    lp = &l1_map[index >> L2_BITS];
+    return &l1_map[index >> L2_BITS];
+}
+
+static inline PageDesc *page_find_alloc(target_ulong index)
+{
+    PageDesc **lp, *p;
+    lp = page_l1_map(index);
+    if (!lp)
+        return NULL;
+
     p = *lp;
     if (!p) {
         /* allocate if not found */
@@ -323,9 +330,12 @@ static inline PageDesc *page_find_alloc(
 
 static inline PageDesc *page_find(target_ulong index)
 {
-    PageDesc *p;
+    PageDesc **lp, *p;
+    lp = page_l1_map(index);
+    if (!lp)
+        return NULL;
 
-    p = l1_map[index >> L2_BITS];
+    p = *lp;
     if (!p)
         return 0;
     return p + (index & (L2_SIZE - 1));


Index: kvm.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kvm/devel/kvm.spec,v
retrieving revision 1.70
retrieving revision 1.71
diff -u -r1.70 -r1.71
--- kvm.spec	9 Sep 2008 15:46:26 -0000	1.70
+++ kvm.spec	15 Sep 2008 21:07:56 -0000	1.71
@@ -1,7 +1,7 @@
 Summary: Kernel-based Virtual Machine
 Name: kvm
 Version: 74
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: GPLv2+ and LGPLv2+
 Group: Development/Tools
 URL: http://%{name}.sf.net
@@ -11,6 +11,7 @@
 Patch0: %{name}-bootmenu.patch
 Patch1: %{name}-62-block-rw-range-check.patch
 Patch2: %{name}-74-pxe-boot.patch
+Patch3: %{name}-74-page-find.patch
 # patches from upstream qemu
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: SDL-devel
@@ -40,6 +41,7 @@
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
+%patch3 -p1
 
 %build
 
@@ -110,6 +112,9 @@
 %{_sysconfdir}/sysconfig/modules/%{name}.modules
 
 %changelog
+* Mon Sep 15 2008 Glauber Costa <glommer at redhat.com> - 74-4
+- fix page_find out of bounds access - #462380
+
 * Tue Sep 09 2008 Glauber Costa <glommer at redhat.com> - 74-3
 - fix pxe booting. Needed for oVirt