Patchwork Fix off-by-one error in sizing pSeries hcall table

login
register
mail settings
Submitter David Gibson
Date May 10, 2011, 6:06 a.m.
Message ID <1305007581-27570-1-git-send-email-david@gibson.dropbear.id.au>
Download mbox | patch
Permalink /patch/94951/
State New
Headers show

Comments

David Gibson - May 10, 2011, 6:06 a.m.
The pSeries machine uses two tables to look up guest hcalls for emulation.
One of these is exactly one entry too small to hold all the hcalls it needs
to, leading to memory corruption.

This patch fixes the bug, and while we're at it, make both tables 'static'
since they're never used from other modules.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 hw/spapr_hcall.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
Alexander Graf - May 10, 2011, 6:10 a.m.
On 10.05.2011, at 08:06, David Gibson wrote:

> The pSeries machine uses two tables to look up guest hcalls for emulation.
> One of these is exactly one entry too small to hold all the hcalls it needs
> to, leading to memory corruption.
> 
> This patch fixes the bug, and while we're at it, make both tables 'static'
> since they're never used from other modules.
> 
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>

Thanks, applied to the ppc-next queue.


Alex

Patch

diff --git a/hw/spapr_hcall.c b/hw/spapr_hcall.c
index f88e1d2..5281ba2 100644
--- a/hw/spapr_hcall.c
+++ b/hw/spapr_hcall.c
@@ -455,8 +455,8 @@  static target_ulong h_rtas(CPUState *env, sPAPREnvironment *spapr,
                            nret, rtas_r3 + 12 + 4*nargs);
 }
 
-spapr_hcall_fn papr_hypercall_table[(MAX_HCALL_OPCODE / 4) + 1];
-spapr_hcall_fn kvmppc_hypercall_table[KVMPPC_HCALL_MAX - KVMPPC_HCALL_BASE];
+static spapr_hcall_fn papr_hypercall_table[(MAX_HCALL_OPCODE / 4) + 1];
+static spapr_hcall_fn kvmppc_hypercall_table[KVMPPC_HCALL_MAX - KVMPPC_HCALL_BASE + 1];
 
 void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn)
 {