|
 |
5d360b |
From 8fb3ac70845fbe261407e7782d3e6233e368da8f Mon Sep 17 00:00:00 2001
|
|
|
5d360b |
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
|
|
|
5d360b |
Date: Wed, 13 Dec 2017 13:38:37 +0100
|
|
|
5d360b |
Subject: [PATCH 06/41] fw_cfg: avoid calculating invalid current entry pointer
|
|
|
5d360b |
MIME-Version: 1.0
|
|
|
5d360b |
Content-Type: text/plain; charset=UTF-8
|
|
|
5d360b |
Content-Transfer-Encoding: 8bit
|
|
|
5d360b |
|
|
|
5d360b |
RH-Author: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
5d360b |
Message-id: <20171213133912.26176-7-marcandre.lureau@redhat.com>
|
|
|
5d360b |
Patchwork-id: 78355
|
|
|
5d360b |
O-Subject: [RHEL-7.5 qemu-kvm PATCH v3 06/41] fw_cfg: avoid calculating invalid current entry pointer
|
|
|
5d360b |
Bugzilla: 1411490
|
|
|
5d360b |
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
5d360b |
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
|
|
|
5d360b |
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
5d360b |
|
|
|
5d360b |
From: "Gabriel L. Somlo" <somlo@cmu.edu>
|
|
|
5d360b |
|
|
|
5d360b |
When calculating a pointer to the currently selected fw_cfg item, the
|
|
|
5d360b |
following is used:
|
|
|
5d360b |
|
|
|
5d360b |
FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
|
|
|
5d360b |
|
|
|
5d360b |
When s->cur_entry is FW_CFG_INVALID, we are calculating the address of
|
|
|
5d360b |
a non-existent element in s->entries[arch][...], which is undefined.
|
|
|
5d360b |
|
|
|
5d360b |
This patch ensures the resulting entry pointer is set to NULL whenever
|
|
|
5d360b |
s->cur_entry is FW_CFG_INVALID.
|
|
|
5d360b |
|
|
|
5d360b |
Reported-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
5d360b |
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
5d360b |
Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
|
|
|
5d360b |
Message-id: 1446733972-1602-5-git-send-email-somlo@cmu.edu
|
|
|
5d360b |
Cc: Marc Marí <markmb@redhat.com>
|
|
|
5d360b |
Signed-off-by: Gabriel Somlo <somlo@cmu.edu>
|
|
|
5d360b |
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
5d360b |
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
5d360b |
|
|
|
5d360b |
(cherry picked from commit 66f8fd9dda312191b78d2a2ba2848bcee76127a2)
|
|
|
5d360b |
|
|
|
5d360b |
RHEL: fix minor conflicts due to previous partial backport in commit
|
|
|
5d360b |
ba24567fd90702ea40ff320a79bc921b38510f22.
|
|
|
5d360b |
|
|
|
5d360b |
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
|
5d360b |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
5d360b |
---
|
|
|
5d360b |
hw/nvram/fw_cfg.c | 3 ++-
|
|
|
5d360b |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
5d360b |
|
|
|
5d360b |
diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c
|
|
|
5d360b |
index 85e950c..1317df7 100644
|
|
|
5d360b |
--- a/hw/nvram/fw_cfg.c
|
|
|
5d360b |
+++ b/hw/nvram/fw_cfg.c
|
|
|
5d360b |
@@ -301,7 +301,8 @@ static void fw_cfg_dma_transfer(FWCfgState *s)
|
|
|
5d360b |
}
|
|
|
5d360b |
|
|
|
5d360b |
arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
|
|
|
5d360b |
- e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
|
|
|
5d360b |
+ e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
|
|
|
5d360b |
+ &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
|
|
|
5d360b |
|
|
|
5d360b |
if (dma.control & FW_CFG_DMA_CTL_READ) {
|
|
|
5d360b |
read = 1;
|
|
|
5d360b |
--
|
|
|
5d360b |
1.8.3.1
|
|
|
5d360b |
|