[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] valgrind problem in sun4u_load_kernel()
From: |
Mark Cave-Ayland |
Subject: |
Re: [Qemu-devel] valgrind problem in sun4u_load_kernel() |
Date: |
Sun, 17 Jun 2018 11:22:08 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 |
On 15/06/18 11:37, Thomas Huth wrote:
Hi Mark, hi Artyom,
while using valgrind to fix some issues with the rom_ptr() function
today, I noticed that there is one more problem in sun4u_load_kernel():
The kernel_top variable can be used uninitialized in some cases:
If load_elf() fails and the kernel is loaded via load_aout() or
load_image_targphys(), the kernel_top variable is never set to a valid
value. This could cause some trouble when loading the initrd later. When
you've got some spare time, could you please have a look?
Hmmm that's an interesting one - I'm not immediately aware of any 64-bit
kernels that are a.out rather than ELF, so I wonder if this has been
used to run a.out executables on startup? Any thoughts, Artyom?
If this is the case then we can only have a valid kernel_top with an ELF
kernel then maybe the following is a good enough solution:
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 3975a7b65a..35acf8c96e 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -139,7 +139,7 @@ static uint64_t sun4u_load_kernel(const char
*kernel_filename,
unsigned int i;
long kernel_size;
uint8_t *ptr;
- uint64_t kernel_top;
+ uint64_t kernel_top = 0;
linux_boot = (kernel_filename != NULL);
@@ -172,7 +172,7 @@ static uint64_t sun4u_load_kernel(const char
*kernel_filename,
}
/* load initrd above kernel */
*initrd_size = 0;
- if (initrd_filename) {
+ if (initrd_filename && kernel_top) {
*initrd_addr = TARGET_PAGE_ALIGN(kernel_top);
*initrd_size = load_image_targphys(initrd_filename,
ATB,
Mark.