target-arm: fix a segmentation fault due to illegal memory access

[Qemu-devel] [PATCH] target-arm: fix a segmentation fault due to illegal memory access

Zheng Xiang posted 1 patch 5 years, 10 months ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20180619075821.9884-1-zhengxiang9@huawei.com

Test checkpatch passed

Test docker-mingw@fedora passed

Test docker-quick@centos7 passed

Test s390x failed

target/arm/kvm.c | 1 +
1 file changed, 1 insertion(+)

Expand all Fold all

[Qemu-devel] [PATCH] target-arm: fix a segmentation fault due to illegal memory access

Posted by Zheng Xiang 5 years, 10 months ago

From: Zheng Xiang <xiang.zheng@linaro.org>

The elements of kvm_devices_head list are freed in kvm_arm_machine_init_done(),
but we still access these illegal memory in kvm_arm_devlistener_del().

This will cause segment fault when booting guest with MALLOC_PERTURB_=1.

Signed-off-by: Zheng Xiang <xiang.zheng@linaro.org>
---
 target/arm/kvm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 98f5006..5bf41e1 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -256,6 +256,7 @@ static void kvm_arm_machine_init_done(Notifier *notifier, void *data)
             kvm_arm_set_device_addr(kd);
         }
         memory_region_unref(kd->mr);
+        QSLIST_REMOVE_HEAD(&kvm_devices_head, entries);
         g_free(kd);
     }
     memory_listener_unregister(&devlistener);
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH] target-arm: fix a segmentation fault due to illegal memory access

Posted by no-reply@patchew.org 5 years, 10 months ago

Hi,

This series failed build test on s390x host. Please find the details below.

N/A. Internal error while reading log file



---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to patchew-devel@redhat.com

Re: [Qemu-devel] [PATCH] target-arm: fix a segmentation fault due to illegal memory access

Posted by Peter Maydell 5 years, 10 months ago

On 19 June 2018 at 08:58, Zheng Xiang <zhengxiang9@huawei.com> wrote:
> From: Zheng Xiang <xiang.zheng@linaro.org>
>
> The elements of kvm_devices_head list are freed in kvm_arm_machine_init_done(),
> but we still access these illegal memory in kvm_arm_devlistener_del().
>
> This will cause segment fault when booting guest with MALLOC_PERTURB_=1.
>
> Signed-off-by: Zheng Xiang <xiang.zheng@linaro.org>
> ---
>  target/arm/kvm.c | 1 +
>  1 file changed, 1 insertion(+)



Applied to target-arm.next, thanks.

-- PMM