The address of a packed member is not packed, which may cause accesses
to unaligned pointers. Avoid this by reading the packed value before
passing it to another function.
Cc: Jason Wang <jasowang@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
hw/char/virtio-serial-bus.c | 6 +++---
hw/virtio/vhost-user.c | 7 +++++--
2 files changed, 8 insertions(+), 5 deletions(-)
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 9470bd7..2d236b3 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -664,9 +664,9 @@ static void virtio_serial_save_device(VirtIODevice *vdev, QEMUFile *f)
/* The config space (ignored on the far end in current versions) */
get_config(vdev, (uint8_t *)&config);
- qemu_put_be16s(f, &config.cols);
- qemu_put_be16s(f, &config.rows);
- qemu_put_be32s(f, &config.max_nr_ports);
+ qemu_put_be16(f, config.cols);
+ qemu_put_be16(f, config.rows);
+ qemu_put_be32(f, config.max_nr_ports);
/* The ports map */
max_nr_ports = s->serial.max_virtserial_ports;
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 093675e..3c17207 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -638,8 +638,11 @@ static void slave_read(void *opaque)
switch (msg.request) {
case VHOST_USER_SLAVE_IOTLB_MSG:
- ret = vhost_backend_handle_iotlb_msg(dev, &msg.payload.iotlb);
- break;
+ {
+ struct vhost_iotlb_msg iotlb = msg.payload.iotlb;
+ ret = vhost_backend_handle_iotlb_msg(dev, &iotlb);
+ break;
+ }
default:
error_report("Received unexpected msg type.");
ret = -EINVAL;
--
1.8.3.1
On 01/12/2018 05:11 AM, Paolo Bonzini wrote: > The address of a packed member is not packed, which may cause accesses > to unaligned pointers. Avoid this by reading the packed value before > passing it to another function. > > Cc: Jason Wang <jasowang@redhat.com> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> > --- > hw/char/virtio-serial-bus.c | 6 +++--- > hw/virtio/vhost-user.c | 7 +++++-- > 2 files changed, 8 insertions(+), 5 deletions(-) > Reviewed-by: Eric Blake <eblake@redhat.com> -- Eric Blake, Principal Software Engineer Red Hat, Inc. +1-919-301-3266 Virtualization: qemu.org | libvirt.org
Hi Paolo -- looks like this patch from the beginning of the year got reviewed by Eric but never actually applied anywhere. Unfortunately it doesn't apply to master any more -- any chance you could do a rebase and resend? (I'm looking idly at all the clang warnings about taking addresses of fields in packed structures...) thanks -- PMM On 12 January 2018 at 11:11, Paolo Bonzini <pbonzini@redhat.com> wrote: > The address of a packed member is not packed, which may cause accesses > to unaligned pointers. Avoid this by reading the packed value before > passing it to another function. > > Cc: Jason Wang <jasowang@redhat.com> > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> > --- > hw/char/virtio-serial-bus.c | 6 +++--- > hw/virtio/vhost-user.c | 7 +++++-- > 2 files changed, 8 insertions(+), 5 deletions(-) > > diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c > index 9470bd7..2d236b3 100644 > --- a/hw/char/virtio-serial-bus.c > +++ b/hw/char/virtio-serial-bus.c > @@ -664,9 +664,9 @@ static void virtio_serial_save_device(VirtIODevice *vdev, QEMUFile *f) > > /* The config space (ignored on the far end in current versions) */ > get_config(vdev, (uint8_t *)&config); > - qemu_put_be16s(f, &config.cols); > - qemu_put_be16s(f, &config.rows); > - qemu_put_be32s(f, &config.max_nr_ports); > + qemu_put_be16(f, config.cols); > + qemu_put_be16(f, config.rows); > + qemu_put_be32(f, config.max_nr_ports); > > /* The ports map */ > max_nr_ports = s->serial.max_virtserial_ports; > diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c > index 093675e..3c17207 100644 > --- a/hw/virtio/vhost-user.c > +++ b/hw/virtio/vhost-user.c > @@ -638,8 +638,11 @@ static void slave_read(void *opaque) > > switch (msg.request) { > case VHOST_USER_SLAVE_IOTLB_MSG: > - ret = vhost_backend_handle_iotlb_msg(dev, &msg.payload.iotlb); > - break; > + { > + struct vhost_iotlb_msg iotlb = msg.payload.iotlb; > + ret = vhost_backend_handle_iotlb_msg(dev, &iotlb); > + break; > + } > default: > error_report("Received unexpected msg type."); > ret = -EINVAL; > -- > 1.8.3.1
© 2016 - 2024 Red Hat, Inc.