At this moment, arm_load_dtb() can free machine->fdt when
binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be
retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is
the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to
machine->fdt. And, in that case, the existing g_free(fdt) at the end of
arm_load_dtb() will make machine->fdt point to an invalid memory region.
Since monitor command 'dumpdtb' was introduced a couple of releases
ago, running it with any ARM machine that uses arm_load_dtb() will
crash QEMU.
Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead
of freeing 'fdt', assign it back to ms->fdt.
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-arm@nongnu.org
Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb")
Reported-by: Markus Armbruster <armbru@redhat.com>i
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
hw/arm/boot.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 50e5141116..54f6a3e0b3 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -689,7 +689,10 @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
rom_ptr_for_as(as, addr, size));
- g_free(fdt);
+ if (fdt != ms->fdt) {
+ g_free(ms->fdt);
+ ms->fdt = fdt;
+ }
return size;
--
2.39.2
On 230328 1859, Markus Armbruster wrote: > At this moment, arm_load_dtb() can free machine->fdt when > binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be > retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is > the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to > machine->fdt. And, in that case, the existing g_free(fdt) at the end of > arm_load_dtb() will make machine->fdt point to an invalid memory region. > > Since monitor command 'dumpdtb' was introduced a couple of releases > ago, running it with any ARM machine that uses arm_load_dtb() will > crash QEMU. > > Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead > of freeing 'fdt', assign it back to ms->fdt. > > Cc: Peter Maydell <peter.maydell@linaro.org> > Cc: qemu-arm@nongnu.org > Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb") > Reported-by: Markus Armbruster <armbru@redhat.com>i ^ Seems like a typo -Alex
On 3/30/23 08:58, Alexander Bulekov wrote: > On 230328 1859, Markus Armbruster wrote: >> At this moment, arm_load_dtb() can free machine->fdt when >> binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be >> retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is >> the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to >> machine->fdt. And, in that case, the existing g_free(fdt) at the end of >> arm_load_dtb() will make machine->fdt point to an invalid memory region. >> >> Since monitor command 'dumpdtb' was introduced a couple of releases >> ago, running it with any ARM machine that uses arm_load_dtb() will >> crash QEMU. >> >> Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead >> of freeing 'fdt', assign it back to ms->fdt. >> >> Cc: Peter Maydell <peter.maydell@linaro.org> >> Cc: qemu-arm@nongnu.org >> Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb") >> Reported-by: Markus Armbruster <armbru@redhat.com>i > ^ Seems like a typo > > -Alex Yeah it is. Persisted ever since v2 :D Nice catch! Daniel
On Tue, 28 Mar 2023 at 17:59, Markus Armbruster <armbru@redhat.com> wrote: > > At this moment, arm_load_dtb() can free machine->fdt when > binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be > retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is > the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to > machine->fdt. And, in that case, the existing g_free(fdt) at the end of > arm_load_dtb() will make machine->fdt point to an invalid memory region. > > Since monitor command 'dumpdtb' was introduced a couple of releases > ago, running it with any ARM machine that uses arm_load_dtb() will > crash QEMU. > > Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead > of freeing 'fdt', assign it back to ms->fdt. > > Cc: Peter Maydell <peter.maydell@linaro.org> > Cc: qemu-arm@nongnu.org > Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb") > Reported-by: Markus Armbruster <armbru@redhat.com>i > Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> > Signed-off-by: Markus Armbruster <armbru@redhat.com> > --- > hw/arm/boot.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/hw/arm/boot.c b/hw/arm/boot.c > index 50e5141116..54f6a3e0b3 100644 > --- a/hw/arm/boot.c > +++ b/hw/arm/boot.c > @@ -689,7 +689,10 @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo, > qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds, > rom_ptr_for_as(as, addr, size)); > > - g_free(fdt); > + if (fdt != ms->fdt) { > + g_free(ms->fdt); > + ms->fdt = fdt; > + } > > return size; > > -- Applied to target-arm.next, thanks. -- PMM
On 3/28/23 13:59, Markus Armbruster wrote: > At this moment, arm_load_dtb() can free machine->fdt when > binfo->dtb_filename is NULL. If there's no 'dtb_filename', 'fdt' will be > retrieved by binfo->get_dtb(). If get_dtb() returns machine->fdt, as is > the case of machvirt_dtb() from hw/arm/virt.c, fdt now has a pointer to > machine->fdt. And, in that case, the existing g_free(fdt) at the end of > arm_load_dtb() will make machine->fdt point to an invalid memory region. > > Since monitor command 'dumpdtb' was introduced a couple of releases > ago, running it with any ARM machine that uses arm_load_dtb() will > crash QEMU. > > Let's enable all arm_load_dtb() callers to use dumpdtb properly. Instead > of freeing 'fdt', assign it back to ms->fdt. > > Cc: Peter Maydell <peter.maydell@linaro.org> > Cc: qemu-arm@nongnu.org > Fixes: bf353ad55590f ("qmp/hmp, device_tree.c: introduce dumpdtb") > Reported-by: Markus Armbruster <armbru@redhat.com>i > Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com> > Signed-off-by: Markus Armbruster <armbru@redhat.com> > --- Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com> > hw/arm/boot.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/hw/arm/boot.c b/hw/arm/boot.c > index 50e5141116..54f6a3e0b3 100644 > --- a/hw/arm/boot.c > +++ b/hw/arm/boot.c > @@ -689,7 +689,10 @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo, > qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds, > rom_ptr_for_as(as, addr, size)); > > - g_free(fdt); > + if (fdt != ms->fdt) { > + g_free(ms->fdt); > + ms->fdt = fdt; > + } > > return size; >
© 2016 - 2024 Red Hat, Inc.