cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
26ba25
From f5eecfb16d182d3c37df06bf20e6843f126b33fe Mon Sep 17 00:00:00 2001
26ba25
From: David Hildenbrand <david@redhat.com>
26ba25
Date: Fri, 21 Sep 2018 10:18:00 +0100
26ba25
Subject: [PATCH 3/4] exec: check that alignment is a power of two
26ba25
26ba25
RH-Author: David Hildenbrand <david@redhat.com>
26ba25
Message-id: <20180921101800.27360-1-david@redhat.com>
26ba25
Patchwork-id: 82229
26ba25
O-Subject: [RHEL-8.0 qemu-kvm PATCH] exec: check that alignment is a power of two
26ba25
Bugzilla: 1630746
26ba25
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
26ba25
RH-Acked-by: Pankaj Gupta <pagupta@redhat.com>
26ba25
RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
26ba25
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
26ba25
26ba25
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1630746
26ba25
Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=18439951
26ba25
Branch: rhel8/master-2.12.0
26ba25
Upstream: 61362b71c105ccb151ca16897a7d56534423f390
26ba25
26ba25
Right now we can crash QEMU using e.g.
26ba25
26ba25
qemu-system-x86_64 -m 256M,maxmem=20G,slots=2 \
26ba25
 -object memory-backend-file,id=mem0,size=12288,mem-path=/dev/zero,align=12288 \
26ba25
 -device pc-dimm,id=dimm1,memdev=mem0
26ba25
26ba25
qemu-system-x86_64: util/mmap-alloc.c:115:
26ba25
 qemu_ram_mmap: Assertion `is_power_of_2(align)' failed
26ba25
26ba25
Fix this by adding a proper check.
26ba25
26ba25
Signed-off-by: David Hildenbrand <david@redhat.com>
26ba25
Message-Id: <20180607154705.6316-3-david@redhat.com>
26ba25
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
26ba25
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
26ba25
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
26ba25
(cherry picked from commit 61362b71c105ccb151ca16897a7d56534423f390)
26ba25
Signed-off-by: David Hildenbrand <david@redhat.com>
26ba25
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
26ba25
---
26ba25
 exec.c | 4 ++++
26ba25
 1 file changed, 4 insertions(+)
26ba25
26ba25
diff --git a/exec.c b/exec.c
26ba25
index 02b1efe..22cc7ef 100644
26ba25
--- a/exec.c
26ba25
+++ b/exec.c
26ba25
@@ -1646,6 +1646,10 @@ static void *file_ram_alloc(RAMBlock *block,
26ba25
                    " must be multiples of page size 0x%zx",
26ba25
                    block->mr->align, block->page_size);
26ba25
         return NULL;
26ba25
+    } else if (block->mr->align && !is_power_of_2(block->mr->align)) {
26ba25
+        error_setg(errp, "alignment 0x%" PRIx64
26ba25
+                   " must be a power of two", block->mr->align);
26ba25
+        return NULL;
26ba25
     }
26ba25
     block->mr->align = MAX(block->page_size, block->mr->align);
26ba25
 #if defined(__s390x__)
26ba25
-- 
26ba25
1.8.3.1
26ba25