From nobody Sun May 5 04:03:39 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 152836150468333.133762657389866; Thu, 7 Jun 2018 01:51:44 -0700 (PDT) Received: from localhost ([::1]:56400 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fQqdy-0000jw-Jc for importer@patchew.org; Thu, 07 Jun 2018 04:51:42 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49308) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fQqc5-0007tS-ID for qemu-devel@nongnu.org; Thu, 07 Jun 2018 04:49:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fQqc2-0002ld-Gf for qemu-devel@nongnu.org; Thu, 07 Jun 2018 04:49:45 -0400 Received: from [45.249.212.35] (port=59186 helo=huawei.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fQqc2-0002dh-2J for qemu-devel@nongnu.org; Thu, 07 Jun 2018 04:49:42 -0400 Received: from DGGEMS412-HUB.china.huawei.com (unknown [172.30.72.58]) by Forcepoint Email with ESMTP id 0A5BE3624AE8D; Thu, 7 Jun 2018 16:02:58 +0800 (CST) Received: from localhost (10.177.68.90) by DGGEMS412-HUB.china.huawei.com (10.3.19.212) with Microsoft SMTP Server id 14.3.382.0; Thu, 7 Jun 2018 16:02:53 +0800 From: liujunjie To: , Date: Thu, 7 Jun 2018 16:02:37 +0800 Message-ID: <20180607080237.12360-1-liujunjie23@huawei.com> X-Mailer: git-send-email 2.13.3.windows.1 MIME-Version: 1.0 X-Originating-IP: [10.177.68.90] X-CFilter-Loop: Reflected X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 45.249.212.35 Subject: [Qemu-devel] [PATCH] ps2: check PS2Queue wptr pointer in post_load routine X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: weidong.huang@huawei.com, liujunjie , wangxinxin.wang@huawei.com, qemu-devel@nongnu.org, arei.gonglei@huawei.com, fangying1@huawei.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In commit 802cbcb7300, most issues have been fixed when qemu guest migration. But the queue size still need to check whether is equal to PS2_QUEUE_SIZE. If yes, the wptr should set as 0. Or, wptr would larger than PS2_QUEUE_SIZE and never come back when ps2_queue_noirq is called. This could lead to OOB access, add check to avoid it. Signed-off-by: liujunjie Reviewed-by: Gonglei --- hw/input/ps2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/input/ps2.c b/hw/input/ps2.c index eeec618..fdfcadf 100644 --- a/hw/input/ps2.c +++ b/hw/input/ps2.c @@ -927,7 +927,7 @@ static void ps2_common_post_load(PS2State *s) =20 /* reset rptr/wptr/count */ q->rptr =3D 0; - q->wptr =3D size; + q->wptr =3D (size =3D=3D PS2_QUEUE_SIZE) ? 0 : size; q->count =3D size; s->update_irq(s->update_arg, q->count !=3D 0); } --=20 1.8.3.1