[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] memory: Add function pointers checks to memory_regi
From: |
Salva Peiró |
Subject: |
[Qemu-devel] [PATCH] memory: Add function pointers checks to memory_region_read/write() |
Date: |
Thu, 3 Sep 2015 19:37:23 +0200 |
The file memory.c directly calls the function pointers provided in
the MemoryRegionOps to handle read and write operations for memory regions.
The function pointers are called without checking if the function
pointers are initialised, therefore, causing QEMU to SIGSEGV when
accessing a memory address for which the operation is not defined (and not
initialised)
The patch adds explicit checks to function pointers before issuing the calls.
Signed-off-by: Salva Peiró <address@hidden>
---
memory.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/memory.c b/memory.c
index 5e5f325..d588c5f 100644
--- a/memory.c
+++ b/memory.c
@@ -380,6 +380,9 @@ static MemTxResult
memory_region_oldmmio_read_accessor(MemoryRegion *mr,
{
uint64_t tmp;
+ if (!mr->ops->old_mmio.read) {
+ return MEMTX_ERROR;
+ }
tmp = mr->ops->old_mmio.read[ctz32(size)](mr->opaque, addr);
trace_memory_region_ops_read(mr, addr, tmp, size);
*value |= (tmp & mask) << shift;
@@ -396,6 +399,9 @@ static MemTxResult
memory_region_read_accessor(MemoryRegion *mr,
{
uint64_t tmp;
+ if (!mr->ops->read) {
+ return MEMTX_ERROR;
+ }
tmp = mr->ops->read(mr->opaque, addr, size);
trace_memory_region_ops_read(mr, addr, tmp, size);
*value |= (tmp & mask) << shift;
@@ -413,6 +419,9 @@ static MemTxResult
memory_region_read_with_attrs_accessor(MemoryRegion *mr,
uint64_t tmp = 0;
MemTxResult r;
+ if (!mr->ops->read_with_attrs) {
+ return MEMTX_ERROR;
+ }
r = mr->ops->read_with_attrs(mr->opaque, addr, &tmp, size, attrs);
trace_memory_region_ops_read(mr, addr, tmp, size);
*value |= (tmp & mask) << shift;
@@ -429,6 +438,9 @@ static MemTxResult
memory_region_oldmmio_write_accessor(MemoryRegion *mr,
{
uint64_t tmp;
+ if (!mr->ops->old_mmio.write) {
+ return MEMTX_ERROR;
+ }
tmp = (*value >> shift) & mask;
trace_memory_region_ops_write(mr, addr, tmp, size);
mr->ops->old_mmio.write[ctz32(size)](mr->opaque, addr, tmp);
@@ -447,6 +459,9 @@ static MemTxResult
memory_region_write_accessor(MemoryRegion *mr,
tmp = (*value >> shift) & mask;
trace_memory_region_ops_write(mr, addr, tmp, size);
+ if (!mr->ops->write) {
+ return MEMTX_ERROR;
+ }
mr->ops->write(mr->opaque, addr, tmp, size);
return MEMTX_OK;
}
@@ -463,6 +478,9 @@ static MemTxResult
memory_region_write_with_attrs_accessor(MemoryRegion *mr,
tmp = (*value >> shift) & mask;
trace_memory_region_ops_write(mr, addr, tmp, size);
+ if (!mr->ops->write_with_attrs) {
+ return MEMTX_ERROR;
+ }
return mr->ops->write_with_attrs(mr->opaque, addr, tmp, size, attrs);
}
@@ -1187,6 +1205,8 @@ void memory_region_init_io(MemoryRegion *mr,
uint64_t size)
{
memory_region_init(mr, owner, name, size);
+ assert(ops != NULL);
+
mr->ops = ops;
mr->opaque = opaque;
mr->terminates = true;
--
2.1.4
- [Qemu-devel] [PATCH] memory: Add function pointers checks to memory_region_read/write(),
Salva Peiró <=