From 8fb3ac70845fbe261407e7782d3e6233e368da8f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Wed, 13 Dec 2017 13:38:37 +0100 Subject: [PATCH 06/41] fw_cfg: avoid calculating invalid current entry pointer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Marc-André Lureau Message-id: <20171213133912.26176-7-marcandre.lureau@redhat.com> Patchwork-id: 78355 O-Subject: [RHEL-7.5 qemu-kvm PATCH v3 06/41] fw_cfg: avoid calculating invalid current entry pointer Bugzilla: 1411490 RH-Acked-by: Laszlo Ersek RH-Acked-by: Michael S. Tsirkin RH-Acked-by: Miroslav Rezanina From: "Gabriel L. Somlo" When calculating a pointer to the currently selected fw_cfg item, the following is used: FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; When s->cur_entry is FW_CFG_INVALID, we are calculating the address of a non-existent element in s->entries[arch][...], which is undefined. This patch ensures the resulting entry pointer is set to NULL whenever s->cur_entry is FW_CFG_INVALID. Reported-by: Laszlo Ersek Reviewed-by: Laszlo Ersek Signed-off-by: Gabriel Somlo Message-id: 1446733972-1602-5-git-send-email-somlo@cmu.edu Cc: Marc Marí Signed-off-by: Gabriel Somlo Reviewed-by: Laszlo Ersek Signed-off-by: Gerd Hoffmann (cherry picked from commit 66f8fd9dda312191b78d2a2ba2848bcee76127a2) RHEL: fix minor conflicts due to previous partial backport in commit ba24567fd90702ea40ff320a79bc921b38510f22. Signed-off-by: Marc-André Lureau Signed-off-by: Miroslav Rezanina --- hw/nvram/fw_cfg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c index 85e950c..1317df7 100644 --- a/hw/nvram/fw_cfg.c +++ b/hw/nvram/fw_cfg.c @@ -301,7 +301,8 @@ static void fw_cfg_dma_transfer(FWCfgState *s) } arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL); - e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; + e = (s->cur_entry == FW_CFG_INVALID) ? NULL : + &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; if (dma.control & FW_CFG_DMA_CTL_READ) { read = 1; -- 1.8.3.1