At 2015/4/17 23:13, Michael S. Tsirkin Wrote:

VHOST_SET_LOG_BASE got an incorrect address, causing
migration errors and potentially even memory corruption.

Reported-by: Wen Congyang <we...@cn.fujitsu.com> <we...@cn.fujitsu.com>
Signed-off-by: Michael S. Tsirkin <m...@redhat.com> <m...@redhat.com>
---

changed (uint64_t)(unsigned long) to (uintptr_t).
Untested.
Wen Congyang, can you pls test and confirm.


I test it, and it works for me.

Thanks
Wen Congyang


  hw/virtio/vhost.c | 7 +++++--
  1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 8dd2f59..b83675f 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -288,7 +288,7 @@ static inline void vhost_dev_log_resize(struct
vhost_dev* dev, uint64_t size)
      int r;

      log = g_malloc0(size * sizeof *log);
-    log_base = (uint64_t)(unsigned long)log;
+    log_base = (uintptr_t)log;
      r = dev->vhost_ops->vhost_call(dev, VHOST_SET_LOG_BASE, &log_base);
      assert(r >= 0);
      /* Sync only the range covered by the old log */
@@ -1016,10 +1016,13 @@ int vhost_dev_start(struct vhost_dev *hdev,
VirtIODevice *vdev)
      }

      if (hdev->log_enabled) {
+        uint64_t log_base;
+
          hdev->log_size = vhost_get_log_size(hdev);
          hdev->log = hdev->log_size ?
              g_malloc0(hdev->log_size * sizeof *hdev->log) : NULL;
-        r = hdev->vhost_ops->vhost_call(hdev, VHOST_SET_LOG_BASE,
hdev->log);
+        log_base = (uintptr_t)hdev->log;
+        r = hdev->vhost_ops->vhost_call(hdev, VHOST_SET_LOG_BASE,
&log_base);
          if (r < 0) {
              r = -errno;
              goto fail_log;

Reply via email to