| Message ID | 20190624090200.5383-1-imammedo@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size() | expand |
On 6/24/19 11:02 AM, Igor Mammedov wrote: > QEMU will crash when device-memory-region-size property is read if ms->device_memory > wasn't initialized yet. > > Crash can be reproduced with: > $QEMU -preconfig -qmp unix:qmp_socket,server,nowait & > ./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size > > Instead of crashing return 0 if ms->device_memory hasn't been initialized. > > Signed-off-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> > --- > > v2: > * fix missing return value assignment > (Eduardo Habkost <ehabkost@redhat.com>) > --- > hw/i386/pc.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/hw/i386/pc.c b/hw/i386/pc.c > index e96360b47a..552f3401e2 100644 > --- a/hw/i386/pc.c > +++ b/hw/i386/pc.c > @@ -2458,7 +2458,11 @@ pc_machine_get_device_memory_region_size(Object *obj, Visitor *v, > Error **errp) > { > MachineState *ms = MACHINE(obj); > - int64_t value = memory_region_size(&ms->device_memory->mr); > + int64_t value = 0; > + > + if (ms->device_memory) { > + value = memory_region_size(&ms->device_memory->mr); > + } > > visit_type_int(v, name, &value, errp); > } >
On Mon, Jun 24, 2019 at 05:02:00AM -0400, Igor Mammedov wrote: > QEMU will crash when device-memory-region-size property is read if ms->device_memory > wasn't initialized yet. > > Crash can be reproduced with: > $QEMU -preconfig -qmp unix:qmp_socket,server,nowait & > ./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size > > Instead of crashing return 0 if ms->device_memory hasn't been initialized. > > Signed-off-by: Igor Mammedov <imammedo@redhat.com> queued, thanks! > --- > > v2: > * fix missing return value assignment > (Eduardo Habkost <ehabkost@redhat.com>) > --- > hw/i386/pc.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/hw/i386/pc.c b/hw/i386/pc.c > index e96360b47a..552f3401e2 100644 > --- a/hw/i386/pc.c > +++ b/hw/i386/pc.c > @@ -2458,7 +2458,11 @@ pc_machine_get_device_memory_region_size(Object *obj, Visitor *v, > Error **errp) > { > MachineState *ms = MACHINE(obj); > - int64_t value = memory_region_size(&ms->device_memory->mr); > + int64_t value = 0; > + > + if (ms->device_memory) { > + value = memory_region_size(&ms->device_memory->mr); > + } > > visit_type_int(v, name, &value, errp); > } > -- > 2.18.1
On 17/07/19 12:37, Michael S. Tsirkin wrote: > On Mon, Jun 24, 2019 at 05:02:00AM -0400, Igor Mammedov wrote: >> QEMU will crash when device-memory-region-size property is read if ms->device_memory >> wasn't initialized yet. >> >> Crash can be reproduced with: >> $QEMU -preconfig -qmp unix:qmp_socket,server,nowait & >> ./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size >> >> Instead of crashing return 0 if ms->device_memory hasn't been initialized. >> >> Signed-off-by: Igor Mammedov <imammedo@redhat.com> > > queued, thanks! This is already commit 58164eaff530a1e804f5710936dd37518ab5a90e. Paolo
On Wed, Jul 17, 2019 at 01:22:27PM +0200, Paolo Bonzini wrote: > On 17/07/19 12:37, Michael S. Tsirkin wrote: > > On Mon, Jun 24, 2019 at 05:02:00AM -0400, Igor Mammedov wrote: > >> QEMU will crash when device-memory-region-size property is read if ms->device_memory > >> wasn't initialized yet. > >> > >> Crash can be reproduced with: > >> $QEMU -preconfig -qmp unix:qmp_socket,server,nowait & > >> ./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size > >> > >> Instead of crashing return 0 if ms->device_memory hasn't been initialized. > >> > >> Signed-off-by: Igor Mammedov <imammedo@redhat.com> > > > > queued, thanks! > > This is already commit 58164eaff530a1e804f5710936dd37518ab5a90e. > > Paolo In fact yes, git am just silently ignores a patch. Donnu why did it not get dropped from the review inbox, weird. Thanks!
diff --git a/hw/i386/pc.c b/hw/i386/pc.c index e96360b47a..552f3401e2 100644 --- a/hw/i386/pc.c +++ b/hw/i386/pc.c @@ -2458,7 +2458,11 @@ pc_machine_get_device_memory_region_size(Object *obj, Visitor *v, Error **errp) { MachineState *ms = MACHINE(obj); - int64_t value = memory_region_size(&ms->device_memory->mr); + int64_t value = 0; + + if (ms->device_memory) { + value = memory_region_size(&ms->device_memory->mr); + } visit_type_int(v, name, &value, errp); }
QEMU will crash when device-memory-region-size property is read if ms->device_memory wasn't initialized yet. Crash can be reproduced with: $QEMU -preconfig -qmp unix:qmp_socket,server,nowait & ./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size Instead of crashing return 0 if ms->device_memory hasn't been initialized. Signed-off-by: Igor Mammedov <imammedo@redhat.com> --- v2: * fix missing return value assignment (Eduardo Habkost <ehabkost@redhat.com>) --- hw/i386/pc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)