Fix off-by-one error in sizing pSeries hcall table

Submitted by David Gibson on May 10, 2011, 6:06 a.m.

Details

Message ID 1305007581-27570-1-git-send-email-david@gibson.dropbear.id.au
State New
Headers show

Commit Message

David Gibson May 10, 2011, 6:06 a.m.
The pSeries machine uses two tables to look up guest hcalls for emulation.
One of these is exactly one entry too small to hold all the hcalls it needs
to, leading to memory corruption.

This patch fixes the bug, and while we're at it, make both tables 'static'
since they're never used from other modules.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 hw/spapr_hcall.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

Comments

Alexander Graf May 10, 2011, 6:10 a.m.
On 10.05.2011, at 08:06, David Gibson wrote:

> The pSeries machine uses two tables to look up guest hcalls for emulation.
> One of these is exactly one entry too small to hold all the hcalls it needs
> to, leading to memory corruption.
> 
> This patch fixes the bug, and while we're at it, make both tables 'static'
> since they're never used from other modules.
> 
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>

Thanks, applied to the ppc-next queue.


Alex

Patch hide | download patch | download mbox

diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
index f88e1d2..5281ba2 100644
--- a/hw/spapr_hcall.c
+++ b/hw/spapr_hcall.c
@@ -455,8 +455,8 @@  static target_ulong h_rtas(CPUState *env, sPAPREnvironment *spapr,
                            nret, rtas_r3 + 12 + 4*nargs);
 }
 
-spapr_hcall_fn papr_hypercall_table[(MAX_HCALL_OPCODE / 4) + 1];
-spapr_hcall_fn kvmppc_hypercall_table[KVMPPC_HCALL_MAX - KVMPPC_HCALL_BASE];
+static spapr_hcall_fn papr_hypercall_table[(MAX_HCALL_OPCODE / 4) + 1];
+static spapr_hcall_fn kvmppc_hypercall_table[KVMPPC_HCALL_MAX - KVMPPC_HCALL_BASE + 1];
 
 void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn)
 {