From nobody Sun May 5 10:12:43 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1541929323785830.5758967693021; Sun, 11 Nov 2018 01:42:03 -0800 (PST) Received: from localhost ([::1]:41500 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gLmFc-0002Ip-S3 for importer@patchew.org; Sun, 11 Nov 2018 04:41:52 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35165) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gLmEh-0001xI-Op for qemu-devel@nongnu.org; Sun, 11 Nov 2018 04:40:56 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gLmEg-0000B1-Rk for qemu-devel@nongnu.org; Sun, 11 Nov 2018 04:40:55 -0500 Received: from chuckie.co.uk ([82.165.15.123]:45742 helo=s16892447.onlinehome-server.info) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gLmEa-0007WC-4U; Sun, 11 Nov 2018 04:40:48 -0500 Received: from host86-149-46-53.range86-149.btcentralplus.com ([86.149.46.53] helo=kentang.home) by s16892447.onlinehome-server.info with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1gLmEa-00036s-FM; Sun, 11 Nov 2018 09:40:49 +0000 From: Mark Cave-Ayland To: hpoussin@reactos.org, jsnow@redhat.com, kwolf@redhat.com, mreitz@redhat.com, qemu-block@nongnu.org, qemu-devel@nongnu.org, martin@duskware.de Date: Sun, 11 Nov 2018 09:40:23 +0000 Message-Id: <20181111094023.18038-1-mark.cave-ayland@ilande.co.uk> X-Mailer: git-send-email 2.11.0 X-SA-Exim-Connect-IP: 86.149.46.53 X-SA-Exim-Mail-From: mark.cave-ayland@ilande.co.uk X-SA-Exim-Version: 4.2.1 (built Sun, 08 Jan 2012 02:45:44 +0000) X-SA-Exim-Scanned: Yes (on s16892447.onlinehome-server.info) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 82.165.15.123 Subject: [Qemu-devel] [PATCH for-3.1] fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Commit c8a35f1cf0f "fdc: use IsaDma interface instead of global DMA_* functions" accidentally introduced a segfault in fdctrl_stop_transfer() for non-DMA transfers. If fdctrl->dma_chann has not been configured then the fdctrl->dma interface reference isn't initialised during isabus_fdc_realize(). Unfortunately fdctrl_stop_transfer() unconditionally references the DMA interface when finishing the transfer causing a NULL pointer dereference. Fix the issue by adding a check in fdctrl_stop_transfer() so that the DMA interface reference and release method is only invoked if fdctrl->dma_chann has been set. (This issue was discovered by Martin testing a recent change in the NetBSD installer under qemu-system-sparc) Reported-by: Martin Husemann Signed-off-by: Mark Cave-Ayland Reviewed-by: Herv=C3=A9 Poussineau Reviewed-by: John Snow Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- hw/block/fdc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/block/fdc.c b/hw/block/fdc.c index 2e9c1e1e2f..6f19f127a5 100644 --- a/hw/block/fdc.c +++ b/hw/block/fdc.c @@ -1617,7 +1617,7 @@ static void fdctrl_stop_transfer(FDCtrl *fdctrl, uint= 8_t status0, fdctrl->fifo[5] =3D cur_drv->sect; fdctrl->fifo[6] =3D FD_SECTOR_SC; fdctrl->data_dir =3D FD_DIR_READ; - if (!(fdctrl->msr & FD_MSR_NONDMA)) { + if (fdctrl->dma_chann !=3D -1 && !(fdctrl->msr & FD_MSR_NONDMA)) { IsaDmaClass *k =3D ISADMA_GET_CLASS(fdctrl->dma); k->release_DREQ(fdctrl->dma, fdctrl->dma_chann); } --=20 2.11.0