[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 13/15] acpi: fix buffer overrun on migration
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL 13/15] acpi: fix buffer overrun on migration |
Date: |
Thu, 19 Nov 2015 15:36:38 +0200 |
ich calls acpi_gpe_init with length ICH9_PMIO_GPE0_LEN so
ICH9_PMIO_GPE0_LEN/2 bytes are allocated, but then the full
ICH9_PMIO_GPE0_LEN bytes are migrated.
As a quick work-around, allocate twice the memory.
We'll probably want to tweak code to avoid
migrating the extra ICH9_PMIO_GPE0_LEN/2 bytes,
but that is a bit trickier to do without breaking
migration compatibility.
Tested-by: "Dr. David Alan Gilbert" <address@hidden>
Reported-by: "Dr. David Alan Gilbert" <address@hidden>
Cc: address@hidden
Signed-off-by: Michael S. Tsirkin <address@hidden>
---
hw/acpi/core.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/hw/acpi/core.c b/hw/acpi/core.c
index fe6215a..21e113d 100644
--- a/hw/acpi/core.c
+++ b/hw/acpi/core.c
@@ -625,8 +625,12 @@ void acpi_pm1_cnt_reset(ACPIREGS *ar)
void acpi_gpe_init(ACPIREGS *ar, uint8_t len)
{
ar->gpe.len = len;
- ar->gpe.sts = g_malloc0(len / 2);
- ar->gpe.en = g_malloc0(len / 2);
+ /* Only first len / 2 bytes are ever used,
+ * but the caller in ich9.c migrates full len bytes.
+ * TODO: fix ich9.c and drop the extra allocation.
+ */
+ ar->gpe.sts = g_malloc0(len);
+ ar->gpe.en = g_malloc0(len);
}
void acpi_gpe_reset(ACPIREGS *ar)
--
MST
- Re: [Qemu-devel] [PULL 08/15] i440fx: print an error message if user tries to enable iommu, (continued)
- Re: [Qemu-devel] [PULL 08/15] i440fx: print an error message if user tries to enable iommu, Michael S. Tsirkin, 2015/11/19
- Re: [Qemu-devel] [PULL 08/15] i440fx: print an error message if user tries to enable iommu, Michael S. Tsirkin, 2015/11/20
- Re: [Qemu-devel] [PULL 08/15] i440fx: print an error message if user tries to enable iommu, Markus Armbruster, 2015/11/19
- Re: [Qemu-devel] [PULL 08/15] i440fx: print an error message if user tries to enable iommu, Michael S. Tsirkin, 2015/11/20
- Re: [Qemu-devel] [PULL 08/15] i440fx: print an error message if user tries to enable iommu, Bandan Das, 2015/11/20
[Qemu-devel] [PULL 05/15] vhost-user: print original request on error, Michael S. Tsirkin, 2015/11/19
[Qemu-devel] [PULL 09/15] tests/vhost-user-bridge: implement logging of dirty pages, Michael S. Tsirkin, 2015/11/19
[Qemu-devel] [PULL 11/15] vhost-user: ignore qemu-only features, Michael S. Tsirkin, 2015/11/19
[Qemu-devel] [PULL 10/15] specs/vhost-user: fix spec to match reality, Michael S. Tsirkin, 2015/11/19
[Qemu-devel] [PULL 12/15] vhost-user: fix log size, Michael S. Tsirkin, 2015/11/19
[Qemu-devel] [PULL 13/15] acpi: fix buffer overrun on migration,
Michael S. Tsirkin <=
[Qemu-devel] [PULL 14/15] tests: re-enable vhost-user-test, Michael S. Tsirkin, 2015/11/19
[Qemu-devel] [PULL 15/15] exec: silence hugetlbfs warning under qtest, Michael S. Tsirkin, 2015/11/19
Re: [Qemu-devel] [PULL 00/15] vhost, pc: fixes for 2.5, Peter Maydell, 2015/11/19
Re: [Qemu-devel] [PULL 00/15] vhost, pc: fixes for 2.5, Peter Maydell, 2015/11/26