|
 |
218e99 |
From ae31d75c7c2872dfc2172921422bf6b1c8bb6b03 Mon Sep 17 00:00:00 2001
|
|
|
218e99 |
From: Bandan Das <bsd@redhat.com>
|
|
|
218e99 |
Date: Wed, 6 Nov 2013 02:11:01 +0100
|
|
|
218e99 |
Subject: [PATCH 54/81] kvmvapic: Catch invalid ROM size
|
|
|
218e99 |
|
|
|
218e99 |
RH-Author: Bandan Das <bsd@redhat.com>
|
|
|
218e99 |
Message-id: <1383703863-4840-1-git-send-email-bsd@redhat.com>
|
|
|
218e99 |
Patchwork-id: 55471
|
|
|
218e99 |
O-Subject: [PATCH RHEL-7.0 qemu-kvm 1/3] kvmvapic: Catch invalid ROM size
|
|
|
218e99 |
Bugzilla: 920021
|
|
|
218e99 |
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
218e99 |
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
218e99 |
RH-Acked-by: Igor Mammedov <imammedo@redhat.com>
|
|
|
218e99 |
RH-Acked-by: Alex Williamson <alex.williamson@redhat.com>
|
|
|
218e99 |
RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>
|
|
|
218e99 |
|
|
|
218e99 |
From: Jan Kiszka <jan.kiszka@siemens.com>
|
|
|
218e99 |
|
|
|
218e99 |
If not caught early, a zero-length ROM will cause a NULL-pointer access
|
|
|
218e99 |
later on in patch_hypercalls when allocating a zero-length ROM copy and
|
|
|
218e99 |
trying to read from it.
|
|
|
218e99 |
|
|
|
218e99 |
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
|
|
|
218e99 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
218e99 |
(cherry picked from commit 18e5eec4db96a00907eb588a2b803401637c7f67)
|
|
|
218e99 |
|
|
|
218e99 |
Conflicts:
|
|
|
218e99 |
hw/i386/kvmvapic.c
|
|
|
218e99 |
---
|
|
|
218e99 |
hw/i386/kvmvapic.c | 11 +++++++++--
|
|
|
218e99 |
1 file changed, 9 insertions(+), 2 deletions(-)
|
|
|
218e99 |
|
|
|
218e99 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
218e99 |
---
|
|
|
218e99 |
hw/i386/kvmvapic.c | 11 +++++++++--
|
|
|
218e99 |
1 files changed, 9 insertions(+), 2 deletions(-)
|
|
|
218e99 |
|
|
|
218e99 |
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
|
|
|
218e99 |
index a7db94d..a2c7e8f 100644
|
|
|
218e99 |
--- a/hw/i386/kvmvapic.c
|
|
|
218e99 |
+++ b/hw/i386/kvmvapic.c
|
|
|
218e99 |
@@ -572,7 +572,7 @@ static int patch_hypercalls(VAPICROMState *s)
|
|
|
218e99 |
* enable write access to the option ROM so that variables can be updated by
|
|
|
218e99 |
* the guest.
|
|
|
218e99 |
*/
|
|
|
218e99 |
-static void vapic_map_rom_writable(VAPICROMState *s)
|
|
|
218e99 |
+static int vapic_map_rom_writable(VAPICROMState *s)
|
|
|
218e99 |
{
|
|
|
218e99 |
hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK;
|
|
|
218e99 |
MemoryRegionSection section;
|
|
|
218e99 |
@@ -593,6 +593,9 @@ static void vapic_map_rom_writable(VAPICROMState *s)
|
|
|
218e99 |
/* read ROM size from RAM region */
|
|
|
218e99 |
ram = memory_region_get_ram_ptr(section.mr);
|
|
|
218e99 |
rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
|
|
|
218e99 |
+ if (rom_size == 0) {
|
|
|
218e99 |
+ return -1;
|
|
|
218e99 |
+ }
|
|
|
218e99 |
s->rom_size = rom_size;
|
|
|
218e99 |
|
|
|
218e99 |
/* We need to round to avoid creating subpages
|
|
|
218e99 |
@@ -605,11 +608,15 @@ static void vapic_map_rom_writable(VAPICROMState *s)
|
|
|
218e99 |
rom_size);
|
|
|
218e99 |
memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000);
|
|
|
218e99 |
s->rom_mapped_writable = true;
|
|
|
218e99 |
+
|
|
|
218e99 |
+ return 0;
|
|
|
218e99 |
}
|
|
|
218e99 |
|
|
|
218e99 |
static int vapic_prepare(VAPICROMState *s)
|
|
|
218e99 |
{
|
|
|
218e99 |
- vapic_map_rom_writable(s);
|
|
|
218e99 |
+ if (vapic_map_rom_writable(s) < 0) {
|
|
|
218e99 |
+ return -1;
|
|
|
218e99 |
+ }
|
|
|
218e99 |
|
|
|
218e99 |
if (patch_hypercalls(s) < 0) {
|
|
|
218e99 |
return -1;
|
|
|
218e99 |
--
|
|
|
218e99 |
1.7.1
|
|
|
218e99 |
|