)]}'
{
  "commit": "4bc7b4d56657ebf75b986ad46e959cf7232ff26a",
  "tree": "36502da0c03cbc85d66a798cda119fe0ca6c0847",
  "parents": [
    "06b82e2d8ead4d1f9441dbf2b03c31369a8f27bd"
  ],
  "author": {
    "name": "David Gibson",
    "email": "david@gibson.dropbear.id.au",
    "time": "Mon Mar 23 12:51:48 2015 +1100"
  },
  "committer": {
    "name": "Paolo Bonzini",
    "email": "pbonzini@redhat.com",
    "time": "Wed Mar 25 13:38:05 2015 +0100"
  },
  "message": "i6300esb: Fix signed integer overflow\n\nIf the guest programs a sufficiently large timeout value an integer\noverflow can occur in i6300esb_restart_timer().  e.g. if the maximum\npossible timer preload value of 0xfffff is programmed then we end up with\nthe calculation:\n\ntimeout \u003d get_ticks_per_sec() * (0xfffff \u003c\u003c 15) / 33000000;\n\nget_ticks_per_sec() returns 1000000000 (10^9) giving:\n\n     10^9 * (0xfffff * 2^15) \u003d\u003d 0x1dcd632329b000000 (65 bits)\n\nObviously the division by 33MHz brings it back under 64-bits, but the\noverflow has already occurred.\n\nSince signed integer overflow has undefined behaviour in C, in theory this\ncould be arbitrarily bad.  In practice, the overflowed value wraps around\nto something negative, causing the watchdog to immediately expire, killing\nthe guest, which is still fairly bad.\n\nThe bug can be triggered by running a Linux guest, loading the i6300esb\ndriver with parameter \"heartbeat\u003d2046\" and opening /dev/watchdog.  The\nwatchdog will trigger as soon as the device is opened.\n\nThis patch corrects the problem by using muldiv64(), which effectively\nallows a 128-bit intermediate value between the multiplication and\ndivision.\n\nSigned-off-by: David Gibson \u003cdavid@gibson.dropbear.id.au\u003e\nMessage-Id: \u003c1427075508-12099-3-git-send-email-david@gibson.dropbear.id.au\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e694fa9969557d09cd657d5f9ad5225a5026747e",
      "old_mode": 33188,
      "old_path": "hw/watchdog/wdt_i6300esb.c",
      "new_id": "4ebdbb8586f4f3c7f5a784f2d5351bb4708ddb12",
      "new_mode": 33188,
      "new_path": "hw/watchdog/wdt_i6300esb.c"
    }
  ]
}