[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v4 4/6] fw_cfg: avoid calculating invalid curren
From: |
Laszlo Ersek |
Subject: |
Re: [Qemu-devel] [PATCH v4 4/6] fw_cfg: avoid calculating invalid current entry pointer |
Date: |
Wed, 4 Nov 2015 15:33:04 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 |
On 11/03/15 22:40, Gabriel L. Somlo wrote:
> When calculating a pointer to the currently selected fw_cfg item, the
> following is used:
>
> FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
>
> When s->cur_entry is FW_CFG_INVALID, we are calculating the address of
> a non-existent element in s->entries[arch][...], which is undefined.
>
> This patch ensures the resulting entry pointer is se to NULL whenever
se[t] to NULL
> s->cur_entry is FW_CFG_INVALID.
>
> Reported-by: Laszlo Ersek <address@hidden>
> Cc: Marc MarĂ <address@hidden>
> Signed-off-by: Gabriel Somlo <address@hidden>
> ---
> hw/nvram/fw_cfg.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
> index c2d3a0a..046fa74 100644
> --- a/hw/nvram/fw_cfg.c
> +++ b/hw/nvram/fw_cfg.c
> @@ -277,7 +277,8 @@ static int fw_cfg_select(FWCfgState *s, uint16_t key)
> static uint8_t fw_cfg_read(FWCfgState *s)
> {
> int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
> - FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
> + FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
> + &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
> uint8_t ret;
>
> if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >=
> e->len)
> @@ -342,7 +343,8 @@ static void fw_cfg_dma_transfer(FWCfgState *s)
> }
>
> arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
> - e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
> + e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
> + &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
>
> if (dma.control & FW_CFG_DMA_CTL_READ) {
> read = 1;
>
Reviewed-by: Laszlo Ersek <address@hidden>
- [Qemu-devel] [PATCH v4 0/6] fw_cfg: spec update, misc. cleanup, optimize read, Gabriel L. Somlo, 2015/11/03
- [Qemu-devel] [PATCH v4 4/6] fw_cfg: avoid calculating invalid current entry pointer, Gabriel L. Somlo, 2015/11/03
- Re: [Qemu-devel] [PATCH v4 4/6] fw_cfg: avoid calculating invalid current entry pointer,
Laszlo Ersek <=
- [Qemu-devel] [PATCH v4 6/6] fw_cfg: replace ioport data read with generic method, Gabriel L. Somlo, 2015/11/03
- [Qemu-devel] [PATCH v4 3/6] fw_cfg: remove offset argument from callback prototype, Gabriel L. Somlo, 2015/11/03
- [Qemu-devel] [PATCH v4 2/6] fw_cfg: amend callback behavior spec to once per select, Gabriel L. Somlo, 2015/11/03
- [Qemu-devel] [PATCH v4 1/6] fw_cfg: move internal function call docs to header file, Gabriel L. Somlo, 2015/11/03
- [Qemu-devel] [PATCH v4 5/6] fw_cfg: add generic non-DMA read method, Gabriel L. Somlo, 2015/11/03