translate-all: fix uninitialized tb->orig_tb

[PATCH] translate-all: fix uninitialized tb->orig_tb

Clement Deschamps posted 1 patch 4 years, 6 months ago

Download mbox

Test asan passed

Test checkpatch passed

Test FreeBSD passed

Test docker-mingw@fedora passed

Test docker-clang@ubuntu passed

Test docker-quick@centos7 passed

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20191022140016.918371-1-clement.deschamps@greensocs.com

Maintainers: Richard Henderson <rth@twiddle.net>, Paolo Bonzini <pbonzini@redhat.com>

accel/tcg/translate-all.c | 1 +
1 file changed, 1 insertion(+)

Expand all Fold all

[PATCH] translate-all: fix uninitialized tb->orig_tb

Posted by Clement Deschamps 4 years, 6 months ago

This fixes a segmentation fault in icount mode when executing from an IO region.

TB is marked as CF_NOCACHE but tb->orig_tb is not initialized (equals
previous value in code_gen_buffer).

The issue happens in cpu_io_recompile() when it tries to invalidate orig_tb.

Signed-off-by: Clement Deschamps <clement.deschamps@greensocs.com>
---
 accel/tcg/translate-all.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 66d4bc4341..f9b7ba159d 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -1722,6 +1722,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
     tb->cs_base = cs_base;
     tb->flags = flags;
     tb->cflags = cflags;
+    tb->orig_tb = NULL;
     tb->trace_vcpu_dstate = *cpu->trace_dstate;
     tcg_ctx->tb_cflags = cflags;
  tb_overflow:
-- 
2.23.0

Re: [PATCH] translate-all: fix uninitialized tb->orig_tb

Posted by Richard Henderson 4 years, 5 months ago

On 10/22/19 10:00 AM, Clement Deschamps wrote:
> This fixes a segmentation fault in icount mode when executing from an IO region.
> 
> TB is marked as CF_NOCACHE but tb->orig_tb is not initialized (equals
> previous value in code_gen_buffer).
> 
> The issue happens in cpu_io_recompile() when it tries to invalidate orig_tb.
> 
> Signed-off-by: Clement Deschamps <clement.deschamps@greensocs.com>
> ---
>  accel/tcg/translate-all.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
> index 66d4bc4341..f9b7ba159d 100644
> --- a/accel/tcg/translate-all.c
> +++ b/accel/tcg/translate-all.c
> @@ -1722,6 +1722,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu,
>      tb->cs_base = cs_base;
>      tb->flags = flags;
>      tb->cflags = cflags;
> +    tb->orig_tb = NULL;

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Yep, the key is the the I/O region, when phys_pc == -1; previously the only
place that set CF_NOCACHE was cpu_exec_nocache, which is where orig_tb is
normally set.

Queued.


r~