[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 08/17] exec: Fix bounce buffer allocation in address_
From: |
Kevin Wolf |
Subject: |
[Qemu-devel] [PULL 08/17] exec: Fix bounce buffer allocation in address_space_map() |
Date: |
Tue, 29 Oct 2013 17:31:00 +0100 |
This fixes a regression introduced by commit e3127ae0c, which kept the
allocation size of the bounce buffer limited to one page in order to
avoid unbounded allocations (as explained in the commit message of
6d16c2f88), but broke the reporting of the shortened bounce buffer to
the caller. The caller therefore assumes that the full requested size
was provided and causes memory corruption when writing beyond the end of
the actually allocated buffer.
Signed-off-by: Kevin Wolf <address@hidden>
---
exec.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/exec.c b/exec.c
index 2e31ffc..b453713 100644
--- a/exec.c
+++ b/exec.c
@@ -2099,7 +2099,9 @@ void *address_space_map(AddressSpace *as,
if (bounce.buffer) {
return NULL;
}
- bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE);
+ /* Avoid unbounded allocations */
+ l = MIN(l, TARGET_PAGE_SIZE);
+ bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, l);
bounce.addr = addr;
bounce.len = l;
--
1.8.1.4
- [Qemu-devel] [PULL 00/17] Block patches, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 01/17] qapi: fix documentation example, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 04/17] qemu-img: add special exit code if bdrv_check is not supported, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 02/17] qcow2: Restore total_sectors value in save_vmstate, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 05/17] block/vpc: check that the image has not been truncated, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 03/17] qcow2: Unset zero_beyond_eof in save_vmstate, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 06/17] qemu-iotests: Test for loading VM state from qcow2, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 07/17] qcow2: Flush image after creation, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 08/17] exec: Fix bounce buffer allocation in address_space_map(),
Kevin Wolf <=
- [Qemu-devel] [PULL 09/17] ide-test: Check what happens with bus mastering disabled, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 10/17] tests: Multiboot mmap test case, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 11/17] block: Don't copy backing file name on error, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 12/17] sheepdog: explicitly set copies as type uint8_t, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 13/17] sheepdog: pass copy_policy in the request, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 14/17] ahci: fix win7 hang on boot, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 15/17] block: Disable BDRV_O_COPY_ON_READ for the backing file, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 16/17] block: Avoid unecessary drv->bdrv_getlength() calls, Kevin Wolf, 2013/10/29
- [Qemu-devel] [PULL 17/17] qemu-iotests: Fix 051 reference output, Kevin Wolf, 2013/10/29