[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 15/34] target/arm: Fix temp double-free in sve ldr/str
From: |
Peter Maydell |
Subject: |
[PULL 15/34] target/arm: Fix temp double-free in sve ldr/str |
Date: |
Fri, 3 Jul 2020 17:53:46 +0100 |
From: Richard Henderson <richard.henderson@linaro.org>
The temp that gets assigned to clean_addr has been allocated with
new_tmp_a64, which means that it will be freed at the end of the
instruction. Freeing it earlier leads to assertion failure.
The loop creates a complication, in which we allocate a new local
temp, which does need freeing, and the final code path is shared
between the loop and non-loop.
Fix this complication by adding new_tmp_a64_local so that the new
local temp is freed at the end, and can be treated exactly like
the non-loop path.
Fixes: bba87d0a0f4
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200702175605.1987125-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
target/arm/translate-a64.h | 1 +
target/arm/translate-a64.c | 6 ++++++
target/arm/translate-sve.c | 8 ++------
3 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index 49e4865918d..647f0c74f62 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -30,6 +30,7 @@ void unallocated_encoding(DisasContext *s);
} while (0)
TCGv_i64 new_tmp_a64(DisasContext *s);
+TCGv_i64 new_tmp_a64_local(DisasContext *s);
TCGv_i64 new_tmp_a64_zero(DisasContext *s);
TCGv_i64 cpu_reg(DisasContext *s, int reg);
TCGv_i64 cpu_reg_sp(DisasContext *s, int reg);
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 73d753f11fb..8c0764957c8 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -461,6 +461,12 @@ TCGv_i64 new_tmp_a64(DisasContext *s)
return s->tmp_a64[s->tmp_a64_count++] = tcg_temp_new_i64();
}
+TCGv_i64 new_tmp_a64_local(DisasContext *s)
+{
+ assert(s->tmp_a64_count < TMP_A64_MAX);
+ return s->tmp_a64[s->tmp_a64_count++] = tcg_temp_local_new_i64();
+}
+
TCGv_i64 new_tmp_a64_zero(DisasContext *s)
{
TCGv_i64 t = new_tmp_a64(s);
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index f318ca265f2..08f0fd15b28 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -4372,9 +4372,8 @@ static void do_ldr(DisasContext *s, uint32_t vofs, int
len, int rn, int imm)
/* Copy the clean address into a local temp, live across the loop. */
t0 = clean_addr;
- clean_addr = tcg_temp_local_new_i64();
+ clean_addr = new_tmp_a64_local(s);
tcg_gen_mov_i64(clean_addr, t0);
- tcg_temp_free_i64(t0);
gen_set_label(loop);
@@ -4422,7 +4421,6 @@ static void do_ldr(DisasContext *s, uint32_t vofs, int
len, int rn, int imm)
tcg_gen_st_i64(t0, cpu_env, vofs + len_align);
tcg_temp_free_i64(t0);
}
- tcg_temp_free_i64(clean_addr);
}
/* Similarly for stores. */
@@ -4463,9 +4461,8 @@ static void do_str(DisasContext *s, uint32_t vofs, int
len, int rn, int imm)
/* Copy the clean address into a local temp, live across the loop. */
t0 = clean_addr;
- clean_addr = tcg_temp_local_new_i64();
+ clean_addr = new_tmp_a64_local(s);
tcg_gen_mov_i64(clean_addr, t0);
- tcg_temp_free_i64(t0);
gen_set_label(loop);
@@ -4509,7 +4506,6 @@ static void do_str(DisasContext *s, uint32_t vofs, int
len, int rn, int imm)
}
tcg_temp_free_i64(t0);
}
- tcg_temp_free_i64(clean_addr);
}
static bool trans_LDR_zri(DisasContext *s, arg_rri *a)
--
2.20.1
- Re: [PULL 05/34] virtio-iommu: Implement RESV_MEM probe request, (continued)
- [PULL 06/34] virtio-iommu: Handle reserved regions in the translation process, Peter Maydell, 2020/07/03
- [PULL 08/34] hw/arm/virt: Let the virtio-iommu bypass MSIs, Peter Maydell, 2020/07/03
- [PULL 07/34] virtio-iommu-pci: Add array of Interval properties, Peter Maydell, 2020/07/03
- [PULL 09/34] target/arm: kvm: Handle DABT with no valid ISS, Peter Maydell, 2020/07/03
- [PULL 10/34] target/arm: kvm: Handle misconfigured dabt injection, Peter Maydell, 2020/07/03
- [PULL 12/34] tests/acpi: virt: allow DSDT acpi table changes, Peter Maydell, 2020/07/03
- [PULL 13/34] hw/arm/virt-acpi-build: Only expose flash on older machine types, Peter Maydell, 2020/07/03
- [PULL 11/34] tests/acpi: remove stale allowed tables, Peter Maydell, 2020/07/03
- [PULL 14/34] tests/acpi: virt: update golden masters for DSDT, Peter Maydell, 2020/07/03
- [PULL 15/34] target/arm: Fix temp double-free in sve ldr/str,
Peter Maydell <=
- [PULL 16/34] hw/display/bcm2835_fb.c: Initialize all fields of struct, Peter Maydell, 2020/07/03
- [PULL 17/34] hw/arm/spitz: Detabify, Peter Maydell, 2020/07/03
- [PULL 19/34] hw/arm/spitz: Keep pointers to MPU and SSI devices in SpitzMachineState, Peter Maydell, 2020/07/03
- [PULL 18/34] hw/arm/spitz: Create SpitzMachineClass abstract base class, Peter Maydell, 2020/07/03
- [PULL 20/34] hw/arm/spitz: Keep pointers to scp0, scp1 in SpitzMachineState, Peter Maydell, 2020/07/03
- [PULL 21/34] hw/arm/spitz: Implement inbound GPIO lines for bit5 and power signals, Peter Maydell, 2020/07/03
- [PULL 22/34] hw/misc/max111x: provide QOM properties for setting initial values, Peter Maydell, 2020/07/03
- [PULL 23/34] hw/misc/max111x: Don't use vmstate_register(), Peter Maydell, 2020/07/03
- [PULL 24/34] ssi: Add ssi_realize_and_unref(), Peter Maydell, 2020/07/03
- [PULL 26/34] hw/misc/max111x: Use GPIO lines rather than max111x_set_input(), Peter Maydell, 2020/07/03