Re: [Qemu-devel] [PATCH v2] i386/acpi: fix gint overflow in crs_range_compare

[Michael S. Tsirkin]

On Thu, Jul 18, 2019 at 07:14:23PM +0300, Evgeny Yakovlev wrote:
> When very large regions (32GB sized in our case, PCI pass-through of GPUs)
> are compared substraction result does not fit into gint.
> 
> As a result crs_replace_with_free_ranges does not get sorted ranges and
> incorrectly computes PCI64 free space regions. Which then makes linux
> guest complain about device and PCI64 hole intersection and device
> becomes unusable.
> 
> Fix that by returning exactly fitting ranges.
> 
> Also fix indentation of an entire crs_replace_with_free_ranges to make
> checkpatch happy.
> 
> Signed-off-by: Evgeny Yakovlev <address@hidden>

queued, thanks a lot!

> ---
> v2:
> entire crs_replace_with_free_ranges was indented with 5 spaces, including my 
> change.
> fix that as well
> 
>  hw/i386/acpi-build.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
> index d281ffa..e7b756b 100644
> --- a/hw/i386/acpi-build.c
> +++ b/hw/i386/acpi-build.c
> @@ -755,10 +755,16 @@ static void crs_range_set_free(CrsRangeSet *range_set)
>  
>  static gint crs_range_compare(gconstpointer a, gconstpointer b)
>  {
> -     CrsRangeEntry *entry_a = *(CrsRangeEntry **)a;
> -     CrsRangeEntry *entry_b = *(CrsRangeEntry **)b;
> +    CrsRangeEntry *entry_a = *(CrsRangeEntry **)a;
> +    CrsRangeEntry *entry_b = *(CrsRangeEntry **)b;
>  
> -     return (int64_t)entry_a->base - (int64_t)entry_b->base;
> +    if (entry_a->base < entry_b->base) {
> +        return -1;
> +    } else if (entry_a->base > entry_b->base) {
> +        return 1;
> +    } else {
> +        return 0;
> +    }
>  }
>  
>  /*
> -- 
> 2.7.4