[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] exec: check 'bounce.in_use' flag before using buffe
From: |
P J P |
Subject: |
[Qemu-devel] [PATCH] exec: check 'bounce.in_use' flag before using buffer |
Date: |
Thu, 28 Jan 2016 20:45:25 +0530 |
From: Prasad J Pandit <address@hidden>
When IDE AHCI emulation uses Frame Information Structures(FIS)
engine for data transfer, the mapped FIS buffer address is stored
in a static 'bounce.buffer'. This is freed when FIS entry is
unmapped. If multiple FIS entries are created, it leads to an
use after free error. Check 'bounce.in_use' flag to avoid it.
Reported-by: Zuozhi fzz <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
exec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/exec.c b/exec.c
index 8718a75..ccc5715 100644
--- a/exec.c
+++ b/exec.c
@@ -2922,7 +2922,7 @@ void address_space_unmap(AddressSpace *as, void *buffer,
hwaddr len,
memory_region_unref(mr);
return;
}
- if (is_write) {
+ if (bounce.in_use && is_write) {
address_space_write(as, bounce.addr, MEMTXATTRS_UNSPECIFIED,
bounce.buffer, access_len);
}
--
2.5.0
- [Qemu-devel] [PATCH] exec: check 'bounce.in_use' flag before using buffer,
P J P <=