From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51290) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VAJUb-00058J-7I for qemu-devel@nongnu.org; Fri, 16 Aug 2013 08:51:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VAJUW-0003wz-3d for qemu-devel@nongnu.org; Fri, 16 Aug 2013 08:51:01 -0400 From: Alex Williamson Date: Fri, 16 Aug 2013 06:50:52 -0600 Message-ID: <20130816124915.12577.72732.stgit@bling.home> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [PATCH v2] exec: Fix non-power-of-2 sized accesses List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: lersek@redhat.com, qemu-stable@nongnu.org, rth@twiddle.net Since commit 23326164 we align access sizes to match the alignment of the address, but we don't align the access size itself. This means we let illegal access sizes (ex. 3) slip through if the address is sufficiently aligned (ex. 4). This results in an abort which would be easy for a guest to trigger. Account for aligning the access size. Signed-off-by: Alex Williamson Cc: qemu-stable@nongnu.org Reviewed-by: Laszlo Ersek --- v2: Remove unnecessary loop condition exec.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/exec.c b/exec.c index 3ca9381..3c19147 100644 --- a/exec.c +++ b/exec.c @@ -1924,6 +1924,13 @@ static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr) } } + /* Size must be a power of 2 */ + if (l & (l - 1)) { + while (l & (access_size_max - 1)) { + access_size_max >>= 1; + } + } + /* Don't attempt accesses larger than the maximum. */ if (l > access_size_max) { l = access_size_max;