[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 4/5] target/i386: avoid theoretical leak on MCE injection
From: |
Paolo Bonzini |
Subject: |
[PULL 4/5] target/i386: avoid theoretical leak on MCE injection |
Date: |
Mon, 16 Nov 2020 14:58:14 -0500 |
g_strdup_printf is used twice to write to the same variable, which
can theoretically cause a leak. In practice, it is extremely
unlikely that a guest is seeing a recursive MCE and has disabled
CR4.MCE between the first and the second error, but we can fix it
and we can also make a slight improvement on the logic: CR4.MCE=0
causes a triple fault even for a non-recursive machine check, so
let's place its test first.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
target/i386/helper.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/target/i386/helper.c b/target/i386/helper.c
index 516ce0cad8..034f46bcc2 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -908,16 +908,14 @@ static void do_inject_x86_mce(CPUState *cs,
run_on_cpu_data data)
return;
}
- if (recursive) {
- need_reset = true;
- msg = g_strdup_printf("CPU %d: Previous MCE still in progress, "
- "raising triple fault", cs->cpu_index);
- }
-
if (!(cenv->cr[4] & CR4_MCE_MASK)) {
need_reset = true;
msg = g_strdup_printf("CPU %d: MCE capability is not enabled, "
"raising triple fault", cs->cpu_index);
+ } else if (recursive) {
+ need_reset = true;
+ msg = g_strdup_printf("CPU %d: Previous MCE still in progress, "
+ "raising triple fault", cs->cpu_index);
}
if (need_reset) {
--
2.26.2
- [PULL 0/5] Misc fixes for QEMU 5.2, Paolo Bonzini, 2020/11/16
- [PULL 1/5] kvm/i386: Set proper nested state format for SVM, Paolo Bonzini, 2020/11/16
- [PULL 3/5] scsi-disk: convert more errno values back to SCSI statuses, Paolo Bonzini, 2020/11/16
- [PULL 4/5] target/i386: avoid theoretical leak on MCE injection,
Paolo Bonzini <=
- [PULL 2/5] util/vfio-helpers.c: Use ram_block_discard_disable() in qemu_vfio_open_pci(), Paolo Bonzini, 2020/11/16
- [PULL 5/5] memory: Skip dirty tracking for un-migratable memory regions, Paolo Bonzini, 2020/11/16
- Re: [PULL 0/5] Misc fixes for QEMU 5.2, Peter Maydell, 2020/11/17