From: David Hildenbrand Date: Mon, 22 Jul 2019 13:41:03 +0000 (+0200) Subject: virtio-balloon: Fix wrong sign extension of PFNs X-Git-Tag: v4.0.1~59 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=912440beb5eee62ffac2b6511ac58fed31bf9b7e;p=thirdparty%2Fqemu.git virtio-balloon: Fix wrong sign extension of PFNs If we directly cast from int to uint64_t, we will first sign-extend to an int64_t, which is wrong. We actually want to treat the PFNs like unsigned values. As far as I can see, this dates back to the initial virtio-balloon commit, but wasn't triggered as fairly big guests would be required. Cc: qemu-stable@nongnu.org Reported-by: Michael S. Tsirkin Signed-off-by: David Hildenbrand Message-Id: <20190722134108.22151-2-david@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Reviewed-by: David Gibson (cherry picked from commit ffa207d08253ffffb3993a1dbe09e40af4fc91f1) Signed-off-by: Michael Roth --- diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index 5579260fd46..49194f5638e 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -343,8 +343,8 @@ static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq) } while (iov_to_buf(elem->out_sg, elem->out_num, offset, &pfn, 4) == 4) { + unsigned int p = virtio_ldl_p(vdev, &pfn); hwaddr pa; - int p = virtio_ldl_p(vdev, &pfn); pa = (hwaddr) p << VIRTIO_BALLOON_PFN_SHIFT; offset += 4;