From patchwork Thu Nov 8 18:21:11 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 197865 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id D06582C00DB for ; Fri, 9 Nov 2012 05:21:29 +1100 (EST) Received: from localhost ([::1]:42490 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TWWjH-0008QH-Io for incoming@patchwork.ozlabs.org; Thu, 08 Nov 2012 13:21:27 -0500 Received: from eggs.gnu.org ([208.118.235.92]:49033) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TWWj6-0008Q6-2Z for qemu-devel@nongnu.org; Thu, 08 Nov 2012 13:21:21 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TWWj5-00076v-3h for qemu-devel@nongnu.org; Thu, 08 Nov 2012 13:21:16 -0500 Received: from mx1.redhat.com ([209.132.183.28]:47776) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TWWj4-00076q-P6 for qemu-devel@nongnu.org; Thu, 08 Nov 2012 13:21:15 -0500 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id qA8ILDJB007364 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 8 Nov 2012 13:21:13 -0500 Received: from rincewind.home.kraxel.org (ovpn-116-29.ams2.redhat.com [10.36.116.29]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id qA8ILCTm018565; Thu, 8 Nov 2012 13:21:13 -0500 Received: by rincewind.home.kraxel.org (Postfix, from userid 500) id ED2624054E; Thu, 8 Nov 2012 19:21:11 +0100 (CET) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Thu, 8 Nov 2012 19:21:11 +0100 Message-Id: <1352398871-21705-1-git-send-email-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: Gerd Hoffmann Subject: [Qemu-devel] [PATCH] Fix piix4_pm savevm buffer overflow. X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org vmstate will read/write 8 bytes for the gpe bits, whereas only two bytes are allocated (and used). So make sure we allocate enougth to not overrun the buffer on savevm and loadvm. Fixing vmstate would probably be better but that has the unpleasent side effect of breaking migration. Signed-off-by: Gerd Hoffmann --- hw/acpi.c | 10 ++++++++-- savevm.c | 6 ++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/hw/acpi.c b/hw/acpi.c index f4aca49..6ed76ff 100644 --- a/hw/acpi.c +++ b/hw/acpi.c @@ -406,9 +406,15 @@ void acpi_pm1_cnt_reset(ACPIREGS *ar) /* ACPI GPE */ void acpi_gpe_init(ACPIREGS *ar, uint8_t len) { + /* + * Hack alert: Although we are using only two bytes (GPE_LEN / 2) + * for each of "sts" and "en" we have to allocate more because + * VMSTATE_GPE_ARRAY() writes 8 bytes (GPE_LEN * sizeof(uint16_t)) + * to the vmstate stream. + */ ar->gpe.len = len; - ar->gpe.sts = g_malloc0(len / 2); - ar->gpe.en = g_malloc0(len / 2); + ar->gpe.sts = g_malloc0(len * 2); + ar->gpe.en = g_malloc0(len * 2); } void acpi_gpe_blk(ACPIREGS *ar, uint32_t blk) diff --git a/savevm.c b/savevm.c index 5d04d59..be0257e 100644 --- a/savevm.c +++ b/savevm.c @@ -1511,6 +1511,8 @@ void vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd, { VMStateField *field = vmsd->fields; + fprintf(stderr, "%s: %s\n", __func__, vmsd->name); + if (vmsd->pre_save) { vmsd->pre_save(opaque); } @@ -1521,6 +1523,8 @@ void vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd, int i, n_elems = 1; int size = field->size; + fprintf(stderr, "%s: %s\n", __func__, field->name); + if (field->flags & VMS_VBUFFER) { size = *(int32_t *)(opaque+field->size_offset); if (field->flags & VMS_MULTIPLY) { @@ -1550,6 +1554,8 @@ void vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd, if (field->flags & VMS_STRUCT) { vmstate_save_state(f, field->vmsd, addr); } else { + fprintf(stderr, "%s: a %p s %d %d/%d\n", __func__, + addr, size, i, n_elems); field->info->put(f, addr, size); } }