* [Qemu-devel] [PATCH v2] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size()
@ 2019-06-24 9:02 Igor Mammedov
2019-06-25 10:17 ` Philippe Mathieu-Daudé
2019-07-17 10:37 ` Michael S. Tsirkin
0 siblings, 2 replies; 5+ messages in thread
From: Igor Mammedov @ 2019-06-24 9:02 UTC (permalink / raw)
To: qemu-devel; +Cc: pbonzini, rth, ehabkost, armbru, mst
QEMU will crash when device-memory-region-size property is read if ms->device_memory
wasn't initialized yet.
Crash can be reproduced with:
$QEMU -preconfig -qmp unix:qmp_socket,server,nowait &
./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size
Instead of crashing return 0 if ms->device_memory hasn't been initialized.
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
---
v2:
* fix missing return value assignment
(Eduardo Habkost <ehabkost@redhat.com>)
---
hw/i386/pc.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index e96360b47a..552f3401e2 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -2458,7 +2458,11 @@ pc_machine_get_device_memory_region_size(Object *obj, Visitor *v,
Error **errp)
{
MachineState *ms = MACHINE(obj);
- int64_t value = memory_region_size(&ms->device_memory->mr);
+ int64_t value = 0;
+
+ if (ms->device_memory) {
+ value = memory_region_size(&ms->device_memory->mr);
+ }
visit_type_int(v, name, &value, errp);
}
--
2.18.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [Qemu-devel] [PATCH v2] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size()
2019-06-24 9:02 [Qemu-devel] [PATCH v2] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size() Igor Mammedov
@ 2019-06-25 10:17 ` Philippe Mathieu-Daudé
2019-07-17 10:37 ` Michael S. Tsirkin
1 sibling, 0 replies; 5+ messages in thread
From: Philippe Mathieu-Daudé @ 2019-06-25 10:17 UTC (permalink / raw)
To: Igor Mammedov, qemu-devel; +Cc: pbonzini, mst, ehabkost, armbru, rth
On 6/24/19 11:02 AM, Igor Mammedov wrote:
> QEMU will crash when device-memory-region-size property is read if ms->device_memory
> wasn't initialized yet.
>
> Crash can be reproduced with:
> $QEMU -preconfig -qmp unix:qmp_socket,server,nowait &
> ./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size
>
> Instead of crashing return 0 if ms->device_memory hasn't been initialized.
>
> Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
>
> v2:
> * fix missing return value assignment
> (Eduardo Habkost <ehabkost@redhat.com>)
> ---
> hw/i386/pc.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/hw/i386/pc.c b/hw/i386/pc.c
> index e96360b47a..552f3401e2 100644
> --- a/hw/i386/pc.c
> +++ b/hw/i386/pc.c
> @@ -2458,7 +2458,11 @@ pc_machine_get_device_memory_region_size(Object *obj, Visitor *v,
> Error **errp)
> {
> MachineState *ms = MACHINE(obj);
> - int64_t value = memory_region_size(&ms->device_memory->mr);
> + int64_t value = 0;
> +
> + if (ms->device_memory) {
> + value = memory_region_size(&ms->device_memory->mr);
> + }
>
> visit_type_int(v, name, &value, errp);
> }
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [Qemu-devel] [PATCH v2] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size()
2019-06-24 9:02 [Qemu-devel] [PATCH v2] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size() Igor Mammedov
2019-06-25 10:17 ` Philippe Mathieu-Daudé
@ 2019-07-17 10:37 ` Michael S. Tsirkin
2019-07-17 11:22 ` Paolo Bonzini
1 sibling, 1 reply; 5+ messages in thread
From: Michael S. Tsirkin @ 2019-07-17 10:37 UTC (permalink / raw)
To: Igor Mammedov; +Cc: pbonzini, rth, qemu-devel, armbru, ehabkost
On Mon, Jun 24, 2019 at 05:02:00AM -0400, Igor Mammedov wrote:
> QEMU will crash when device-memory-region-size property is read if ms->device_memory
> wasn't initialized yet.
>
> Crash can be reproduced with:
> $QEMU -preconfig -qmp unix:qmp_socket,server,nowait &
> ./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size
>
> Instead of crashing return 0 if ms->device_memory hasn't been initialized.
>
> Signed-off-by: Igor Mammedov <imammedo@redhat.com>
queued, thanks!
> ---
>
> v2:
> * fix missing return value assignment
> (Eduardo Habkost <ehabkost@redhat.com>)
> ---
> hw/i386/pc.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/hw/i386/pc.c b/hw/i386/pc.c
> index e96360b47a..552f3401e2 100644
> --- a/hw/i386/pc.c
> +++ b/hw/i386/pc.c
> @@ -2458,7 +2458,11 @@ pc_machine_get_device_memory_region_size(Object *obj, Visitor *v,
> Error **errp)
> {
> MachineState *ms = MACHINE(obj);
> - int64_t value = memory_region_size(&ms->device_memory->mr);
> + int64_t value = 0;
> +
> + if (ms->device_memory) {
> + value = memory_region_size(&ms->device_memory->mr);
> + }
>
> visit_type_int(v, name, &value, errp);
> }
> --
> 2.18.1
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [Qemu-devel] [PATCH v2] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size()
2019-07-17 10:37 ` Michael S. Tsirkin
@ 2019-07-17 11:22 ` Paolo Bonzini
2019-07-17 11:24 ` Michael S. Tsirkin
0 siblings, 1 reply; 5+ messages in thread
From: Paolo Bonzini @ 2019-07-17 11:22 UTC (permalink / raw)
To: Michael S. Tsirkin, Igor Mammedov; +Cc: armbru, rth, qemu-devel, ehabkost
On 17/07/19 12:37, Michael S. Tsirkin wrote:
> On Mon, Jun 24, 2019 at 05:02:00AM -0400, Igor Mammedov wrote:
>> QEMU will crash when device-memory-region-size property is read if ms->device_memory
>> wasn't initialized yet.
>>
>> Crash can be reproduced with:
>> $QEMU -preconfig -qmp unix:qmp_socket,server,nowait &
>> ./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size
>>
>> Instead of crashing return 0 if ms->device_memory hasn't been initialized.
>>
>> Signed-off-by: Igor Mammedov <imammedo@redhat.com>
>
> queued, thanks!
This is already commit 58164eaff530a1e804f5710936dd37518ab5a90e.
Paolo
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH v2] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size()
2019-07-17 11:22 ` Paolo Bonzini
@ 2019-07-17 11:24 ` Michael S. Tsirkin
0 siblings, 0 replies; 5+ messages in thread
From: Michael S. Tsirkin @ 2019-07-17 11:24 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: Igor Mammedov, rth, qemu-devel, armbru, ehabkost
On Wed, Jul 17, 2019 at 01:22:27PM +0200, Paolo Bonzini wrote:
> On 17/07/19 12:37, Michael S. Tsirkin wrote:
> > On Mon, Jun 24, 2019 at 05:02:00AM -0400, Igor Mammedov wrote:
> >> QEMU will crash when device-memory-region-size property is read if ms->device_memory
> >> wasn't initialized yet.
> >>
> >> Crash can be reproduced with:
> >> $QEMU -preconfig -qmp unix:qmp_socket,server,nowait &
> >> ./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size
> >>
> >> Instead of crashing return 0 if ms->device_memory hasn't been initialized.
> >>
> >> Signed-off-by: Igor Mammedov <imammedo@redhat.com>
> >
> > queued, thanks!
>
> This is already commit 58164eaff530a1e804f5710936dd37518ab5a90e.
>
> Paolo
In fact yes, git am just silently ignores a patch.
Donnu why did it not get dropped from the review inbox, weird.
Thanks!
--
MST
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-07-17 11:24 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-24 9:02 [Qemu-devel] [PATCH v2] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size() Igor Mammedov
2019-06-25 10:17 ` Philippe Mathieu-Daudé
2019-07-17 10:37 ` Michael S. Tsirkin
2019-07-17 11:22 ` Paolo Bonzini
2019-07-17 11:24 ` Michael S. Tsirkin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).