[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 22/35] fw_cfg: avoid calculating invalid current en
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 22/35] fw_cfg: avoid calculating invalid current entry pointer |
Date: |
Mon, 21 Mar 2016 12:28:20 -0500 |
From: "Gabriel L. Somlo" <address@hidden>
When calculating a pointer to the currently selected fw_cfg item, the
following is used:
FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
When s->cur_entry is FW_CFG_INVALID, we are calculating the address of
a non-existent element in s->entries[arch][...], which is undefined.
This patch ensures the resulting entry pointer is set to NULL whenever
s->cur_entry is FW_CFG_INVALID.
Reported-by: Laszlo Ersek <address@hidden>
Reviewed-by: Laszlo Ersek <address@hidden>
Signed-off-by: Gabriel Somlo <address@hidden>
Message-id: address@hidden
Cc: Marc MarĂ <address@hidden>
Signed-off-by: Gabriel Somlo <address@hidden>
Reviewed-by: Laszlo Ersek <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
(cherry picked from commit 66f8fd9dda312191b78d2a2ba2848bcee76127a2)
Signed-off-by: Michael Roth <address@hidden>
---
hw/nvram/fw_cfg.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
index 73b0a81..117809b 100644
--- a/hw/nvram/fw_cfg.c
+++ b/hw/nvram/fw_cfg.c
@@ -270,7 +270,8 @@ static int fw_cfg_select(FWCfgState *s, uint16_t key)
static uint8_t fw_cfg_read(FWCfgState *s)
{
int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
- FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
+ FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
+ &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
uint8_t ret;
if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >= e->len)
@@ -338,7 +339,8 @@ static void fw_cfg_dma_transfer(FWCfgState *s)
}
arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
- e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
+ e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
+ &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
if (dma.control & FW_CFG_DMA_CTL_READ) {
read = 1;
--
1.9.1
- [Qemu-stable] [PATCH 23/35] cpus: use broadcast on qemu_pause_cond, (continued)
- [Qemu-stable] [PATCH 23/35] cpus: use broadcast on qemu_pause_cond, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 25/35] block: set device_list.tqe_prev to NULL on BDS removal, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 10/35] ivshmem: remove redundant assignment, fix crash with msi=off, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 27/35] e1000: eliminate infinite loops on out-of-bounds transfer start, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 26/35] block: qemu-iotests - add test for snapshot, commit, snapshot bug, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 29/35] hw/virtio: fix double use of a virtio flag, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 30/35] hw/virtio: group virtio flags into an enum, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 32/35] vhost-user: don't merge regions with different fds, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 31/35] fw_cfg: unbreak migration compatibility for 2.4 and earlier machines, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 33/35] target-arm: Make reserved ranges in ID_AA64* spaces RAZ, not UNDEF, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 22/35] fw_cfg: avoid calculating invalid current entry pointer,
Michael Roth <=
- [Qemu-stable] [PATCH 34/35] quorum: Fix crash in quorum_aio_cb(), Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 28/35] spapr: skip configuration section during migration of older machines, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 02/35] net: vmxnet3: avoid memory leakage in activate_device, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 04/35] configure: Fix shell syntax to placate OpenBSD's pdksh, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 05/35] xen/blkif: Avoid double access to src->nr_segments, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 08/35] scsi: initialise info object with appropriate size, Michael Roth, 2016/03/21
- [Qemu-stable] [PATCH 07/35] virtio-9p: use accessor to get thread_pool, Michael Roth, 2016/03/21