Machine next patches

[Qemu-devel] [PULL 15/29] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size()

Eduardo Habkost posted 29 patches 6 years, 3 months ago

Download mbox

Maintainers: Paul Burton <pburton@wavecomp.com>, Paul Durrant <paul.durrant@citrix.com>, Anthony Perard <anthony.perard@citrix.com>, Juan Quintela <quintela@redhat.com>, Rob Herring <robh@kernel.org>, Cornelia Huck <cohuck@redhat.com>, Richard Henderson <rth@twiddle.net>, Jia Liu <proljc@gmail.com>, "Dr. David Alan Gilbert" <dgilbert@redhat.com>, Aleksandar Markovic <amarkovic@wavecomp.com>, Bastian Koppelmann <kbastian@mail.uni-paderborn.de>, David Gibson <david@gibson.dropbear.id.au>, Igor Mammedov <imammedo@redhat.com>, Marcelo Tosatti <mtosatti@redhat.com>, Andrey Smirnov <andrew.smirnov@gmail.com>, Andrew Baumann <Andrew.Baumann@microsoft.com>, Jean-Christophe Dubois <jcd@tribudubois.net>, Stefano Stabellini <sstabellini@kernel.org>, Aleksandar Rikalo <arikalo@wavecomp.com>, Sagar Karandikar <sagark@eecs.berkeley.edu>, Aurelien Jarno <aurelien@aurel32.net>, "Philippe Mathieu-Daudé" <f4bug@amsat.org>, Halil Pasic <pasic@linux.ibm.com>, Stafford Horne <shorne@gmail.com>, Artyom Tarasenko <atar4qemu@gmail.com>, Paolo Bonzini <pbonzini@redhat.com>, Marcel Apfelbaum <marcel.apfelbaum@gmail.com>, Helge Deller <deller@gmx.de>, "Philippe Mathieu-Daudé" <philmd@redhat.com>, "Hervé Poussineau" <hpoussin@reactos.org>, Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>, Palmer Dabbelt <palmer@sifive.com>, Eric Blake <eblake@redhat.com>, Peter Maydell <peter.maydell@linaro.org>, Eduardo Habkost <ehabkost@redhat.com>, Alistair Francis <alistair@alistair23.me>, "Cédric Le Goater" <clg@kaod.org>, "Alex Bennée" <alex.bennee@linaro.org>, "Edgar E. Iglesias" <edgar.iglesias@gmail.com>, Christian Borntraeger <borntraeger@de.ibm.com>, Max Filippov <jcmvbkbc@gmail.com>, Markus Armbruster <armbru@redhat.com>, Alistair Francis <Alistair.Francis@wdc.com>, David Hildenbrand <david@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com>

Expand all Fold all

[Qemu-devel] [PULL 15/29] pc: fix possible NULL pointer dereference in pc_machine_get_device_memory_region_size()

Posted by Eduardo Habkost 6 years, 3 months ago

From: Igor Mammedov <imammedo@redhat.com>

QEMU will crash when device-memory-region-size property is read if ms->device_memory
wasn't initialized yet.

Crash can be reproduced with:
 $QEMU -preconfig -qmp unix:qmp_socket,server,nowait &
 ./scripts/qmp/qom-get -s qmp_socket /machine.device-memory-region-size

Instead of crashing return 0 if ms->device_memory hasn't been initialized.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20190624090200.5383-1-imammedo@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
 hw/i386/pc.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 9921ce4f5e..9b953eeeea 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -2489,7 +2489,11 @@ pc_machine_get_device_memory_region_size(Object *obj, Visitor *v,
                                          Error **errp)
 {
     MachineState *ms = MACHINE(obj);
-    int64_t value = memory_region_size(&ms->device_memory->mr);
+    int64_t value = 0;
+
+    if (ms->device_memory) {
+        value = memory_region_size(&ms->device_memory->mr);
+    }
 
     visit_type_int(v, name, &value, errp);
 }
-- 
2.18.0.rc1.1.g3f1ff2140