[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 02/17] pc: Fix crash when attempting to hotplug CPU w
From: |
Andreas Färber |
Subject: |
[Qemu-devel] [PULL 02/17] pc: Fix crash when attempting to hotplug CPU with negative ID |
Date: |
Thu, 13 Jun 2013 02:45:14 +0200 |
From: Igor Mammedov <address@hidden>
QMP command "{ 'execute': 'cpu-add', 'arguments': { 'id': -1 }}" may cause
QEMU SIGSEGV at:
piix4_cpu_hotplug_req ()
...
g->sts[cpu_id / 8] |= (1 << (cpu_id % 8));
...
Since for PC in current implementation id should be in range [0...maxcpus)
and maxcpus is already checked, add check for lower bound and error out
on incorrect value.
Signed-off-by: Igor Mammedov <address@hidden>
Signed-off-by: Andreas Färber <address@hidden>
---
hw/i386/pc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 4844a6b..553becb 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -927,6 +927,11 @@ void pc_hot_add_cpu(const int64_t id, Error **errp)
DeviceState *icc_bridge;
int64_t apic_id = x86_cpu_apic_id_from_index(id);
+ if (id < 0) {
+ error_setg(errp, "Invalid CPU id: %" PRIi64, id);
+ return;
+ }
+
if (cpu_exists(apic_id)) {
error_setg(errp, "Unable to add CPU: %" PRIi64
", it already exists", id);
--
1.8.1.4
- [Qemu-devel] [PULL 00/17] QOM CPUState patch queue 2013-06-12, Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 01/17] dump: Move stubs into libqemustub.a, Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 02/17] pc: Fix crash when attempting to hotplug CPU with negative ID,
Andreas Färber <=
- [Qemu-devel] [PULL 04/17] target-i386: Update model values on Conroe/Penryn/Nehalem CPU models, Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 03/17] pc: Create pc-*-1.6 machine-types, Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 05/17] target-i386: Set level=4 on Conroe/Penryn/Nehalem, Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 06/17] target-i386: cpu: Fix potential buffer overrun in get_register_name_32(), Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 07/17] monitor: Simplify do_inject_mce() with qemu_get_cpu(), Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 09/17] memory_mapping: Move MemoryMappingList typedef to qemu/typedefs.h, Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 08/17] cpu: Turn cpu_paging_enabled() into a CPUState hook, Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 11/17] memory_mapping: Drop qemu_get_memory_mapping() stub, Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 13/17] cpu: Change default for CPUClass::get_paging_enabled(), Andreas Färber, 2013/06/12
- [Qemu-devel] [PULL 12/17] dump: Drop qmp_dump_guest_memory() stub and build for all targets, Andreas Färber, 2013/06/12