Drivers: hv: hv_balloon: correctly handle num_pages>INT_MAX case
balloon_wrk.num_pages is __u32 and it comes from host in struct dm_balloon where it is also __u32. We, however, use 'int' in balloon_up() and in case we happen to receive num_pages>INT_MAX request we'll end up allocating zero pages as 'num_pages < alloc_unit' check in alloc_balloon_pages() will pass. Change num_pages type to unsigned int. In real life ballooning request come with num_pages in [512, 32768] range so this is more a future-proof/cleanup. Reported-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>hifive-unleashed-5.1
parent
ba0c444153
commit
797f88c987
|
@ -1081,11 +1081,12 @@ static void free_balloon_pages(struct hv_dynmem_device *dm,
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
static int alloc_balloon_pages(struct hv_dynmem_device *dm, int num_pages,
|
static unsigned int alloc_balloon_pages(struct hv_dynmem_device *dm,
|
||||||
struct dm_balloon_response *bl_resp,
|
unsigned int num_pages,
|
||||||
int alloc_unit)
|
struct dm_balloon_response *bl_resp,
|
||||||
|
int alloc_unit)
|
||||||
{
|
{
|
||||||
int i = 0;
|
unsigned int i = 0;
|
||||||
struct page *pg;
|
struct page *pg;
|
||||||
|
|
||||||
if (num_pages < alloc_unit)
|
if (num_pages < alloc_unit)
|
||||||
|
@ -1132,8 +1133,8 @@ static int alloc_balloon_pages(struct hv_dynmem_device *dm, int num_pages,
|
||||||
|
|
||||||
static void balloon_up(struct work_struct *dummy)
|
static void balloon_up(struct work_struct *dummy)
|
||||||
{
|
{
|
||||||
int num_pages = dm_device.balloon_wrk.num_pages;
|
unsigned int num_pages = dm_device.balloon_wrk.num_pages;
|
||||||
int num_ballooned = 0;
|
unsigned int num_ballooned = 0;
|
||||||
struct dm_balloon_response *bl_resp;
|
struct dm_balloon_response *bl_resp;
|
||||||
int alloc_unit;
|
int alloc_unit;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
Loading…
Reference in New Issue