[Qemu-devel][BUG][PATCH] Fix crash in kvm.c

[Stefan Weil]

I got a crash (array access out of bounds results in access fault)
with the current Qemu trunk when kvm is enabled:

qemu -fda fd.img -cdrom cdrom.img -hda hda.img -hdb raw.img -m 256 -boot
c -enable-kvm

Host is Debian x86_64, the crash occurs before any code is emulated.

With the patch, the emulation (Win 98) boots, but has problems with the
display of
icons and the mouse cursor. Qemu displays lots of
"BUG: kvm_physical_sync_dirty_bitmap: invalid parameters" messages.

Stefan

Fix crash with kvm enabled.

Signed-off-by: Stefan Weil <address@hidden> 

Index: target-i386/kvm.c
===================================================================
--- target-i386/kvm.c   (Revision 5889)
+++ target-i386/kvm.c   (Arbeitskopie)
@@ -12,6 +12,7 @@
  *
  */
 
+#include <assert.h>
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <sys/mman.h>
@@ -39,7 +40,8 @@
         struct kvm_cpuid cpuid;
         struct kvm_cpuid_entry entries[100];
     } __attribute__((packed)) cpuid_data;
-    int limit, i, cpuid_i;
+    int limit, cpuid_i;
+    unsigned i;
     uint32_t eax, ebx, ecx, edx;
 
     cpuid_i = 0;
@@ -49,6 +51,7 @@
 
     for (i = 0; i <= limit; i++) {
         struct kvm_cpuid_entry *c = &cpuid_data.entries[cpuid_i++];
+        assert(cpuid_i < 100);
 
         cpu_x86_cpuid(env, i, &eax, &ebx, &ecx, &edx);
         c->function = i;
@@ -63,6 +66,7 @@
 
     for (i = 0x80000000; i <= limit; i++) {
         struct kvm_cpuid_entry *c = &cpuid_data.entries[cpuid_i++];
+        assert(cpuid_i < 100);
 
         cpu_x86_cpuid(env, i, &eax, &ebx, &ecx, &edx);
         c->function = i;