| Message ID | 20230223125747.254914-1-jusual@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] hw/smbios: fix field corruption in type 4 table | expand |
On Thu, 23 Feb 2023 13:57:47 +0100 Julia Suvorova <jusual@redhat.com> wrote: > Since table type 4 of SMBIOS version 2.6 is shorter than 3.0, the > strings which follow immediately after the struct fields have been > overwritten by unconditional filling of later fields such as core_count2. > Make these fields dependent on the SMBIOS version. > > Fixes: 05e27d74c7 ("hw/smbios: add core_count2 to smbios table type 4") > Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2169904 > > Signed-off-by: Julia Suvorova <jusual@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> > --- > v2: > * add fixes tag > * check tbl_len instead of ep_type > > hw/smbios/smbios.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c > index 4869566cf5..d2007e70fb 100644 > --- a/hw/smbios/smbios.c > +++ b/hw/smbios/smbios.c > @@ -750,14 +750,16 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance) > t->core_count = (ms->smp.cores > 255) ? 0xFF : ms->smp.cores; > t->core_enabled = t->core_count; > > - t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores); > - > t->thread_count = (ms->smp.threads > 255) ? 0xFF : ms->smp.threads; > - t->thread_count2 = cpu_to_le16(ms->smp.threads); > > t->processor_characteristics = cpu_to_le16(0x02); /* Unknown */ > t->processor_family2 = cpu_to_le16(0x01); /* Other */ > > + if (tbl_len == SMBIOS_TYPE_4_LEN_V30) { > + t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores); > + t->thread_count2 = cpu_to_le16(ms->smp.threads); > + } > + > SMBIOS_BUILD_TABLE_POST; > smbios_type4_count++; > }
On Thu, Feb 23, 2023 at 6:27 PM Julia Suvorova <jusual@redhat.com> wrote: > > Since table type 4 of SMBIOS version 2.6 is shorter than 3.0, the > strings which follow immediately after the struct fields have been > overwritten by unconditional filling of later fields such as core_count2. > Make these fields dependent on the SMBIOS version. > > Fixes: 05e27d74c7 ("hw/smbios: add core_count2 to smbios table type 4") > Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2169904 > > Signed-off-by: Julia Suvorova <jusual@redhat.com> Reviewed-by: Ani Sinha <ani@anisinha.ca> > --- > v2: > * add fixes tag > * check tbl_len instead of ep_type > > hw/smbios/smbios.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c > index 4869566cf5..d2007e70fb 100644 > --- a/hw/smbios/smbios.c > +++ b/hw/smbios/smbios.c > @@ -750,14 +750,16 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance) > t->core_count = (ms->smp.cores > 255) ? 0xFF : ms->smp.cores; > t->core_enabled = t->core_count; > > - t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores); > - > t->thread_count = (ms->smp.threads > 255) ? 0xFF : ms->smp.threads; > - t->thread_count2 = cpu_to_le16(ms->smp.threads); > > t->processor_characteristics = cpu_to_le16(0x02); /* Unknown */ > t->processor_family2 = cpu_to_le16(0x01); /* Other */ > > + if (tbl_len == SMBIOS_TYPE_4_LEN_V30) { > + t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores); > + t->thread_count2 = cpu_to_le16(ms->smp.threads); > + } > + > SMBIOS_BUILD_TABLE_POST; > smbios_type4_count++; > } > -- > 2.38.1 >
diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c index 4869566cf5..d2007e70fb 100644 --- a/hw/smbios/smbios.c +++ b/hw/smbios/smbios.c @@ -750,14 +750,16 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance) t->core_count = (ms->smp.cores > 255) ? 0xFF : ms->smp.cores; t->core_enabled = t->core_count; - t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores); - t->thread_count = (ms->smp.threads > 255) ? 0xFF : ms->smp.threads; - t->thread_count2 = cpu_to_le16(ms->smp.threads); t->processor_characteristics = cpu_to_le16(0x02); /* Unknown */ t->processor_family2 = cpu_to_le16(0x01); /* Other */ + if (tbl_len == SMBIOS_TYPE_4_LEN_V30) { + t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores); + t->thread_count2 = cpu_to_le16(ms->smp.threads); + } + SMBIOS_BUILD_TABLE_POST; smbios_type4_count++; }
Since table type 4 of SMBIOS version 2.6 is shorter than 3.0, the strings which follow immediately after the struct fields have been overwritten by unconditional filling of later fields such as core_count2. Make these fields dependent on the SMBIOS version. Fixes: 05e27d74c7 ("hw/smbios: add core_count2 to smbios table type 4") Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2169904 Signed-off-by: Julia Suvorova <jusual@redhat.com> --- v2: * add fixes tag * check tbl_len instead of ep_type hw/smbios/smbios.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)