From nobody Sat Sep 26 20:50:49 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=seu.edu.cn ARC-Seal: i=1; a=rsa-sha256; t=1788496381; cv=none; d=zohomail.com; s=zohoarc; b=ixDBFnr7wtHna8T+sn7ai4feW0GT6QP5nU7pYPZ8KloMS46UHl4qAkHynf/rD9+a6KyMc4EU+zWrMluOaxAZ0XNp0UjqN7Wfd20/94/fx+dHNcfWQS1t4xfuHCMhYqhNmaWDoZPlsy9Qt5rY+kdAcx7WX6pFwk3eKK3hC63M9DU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788496381; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=cEN3FPmkQR+mfyk0Hh7Q/XQ8BfLjMjCvjCsiEnuYpQ0=; b=NdK/ItSvs33/lzsTYsKeQspNr9hcWMfLf0EfwiSIuR8jznkKzLNWyTNRhkL9SFoS3Fz46XsGGkDuyYA0Ovty+drA1+rJj5aiejz8Mlhl94VABsaCJht9kcvjz1gsdDfst5hYym5iAkZTwsv4bjN1VyYTGwu1n5Xnv0y8DLtfT9w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1788496379332726.924280272455; Thu, 3 Sep 2026 21:32:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x2LbF-0001Cm-5V; Fri, 04 Sep 2026 00:32:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x2Kmy-0004TH-35; Thu, 03 Sep 2026 23:40:28 -0400 Received: from mail-m155101.qiye.163.com ([101.71.155.101]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x2Kmv-00038f-So; Thu, 03 Sep 2026 23:40:27 -0400 Received: from LAPTOP-99KJFSET (unknown [36.153.54.56]) by smtp.qiye.163.com (Hmail) with ESMTP id 4c7fb79e5; Fri, 4 Sep 2026 11:31:13 +0800 (GMT+08:00) From: Hongyan Xu To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , qemu-stable@nongnu.org, Hongyan Xu Subject: [PATCH] dump: reset guest_note_size when the guest note is discarded Date: Fri, 4 Sep 2026 11:31:12 +0800 Message-ID: <20260904033113.1194-1-getshell@seu.edu.cn> X-Mailer: git-send-email 2.50.1.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0aa06a786f8203a1kunm32f5d9e724039 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVlCSB9KVhpMGkNNHR5NTRpJTFYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlITVVKTkhVTk9VTk1ZV1kWGg8SFR0UWUFZT0tIVUpLSUhOQ0 NVSktLVUtZBg++ DKIM-Signature: a=rsa-sha256; b=eZSOaVKSC4pKGaD+LJCGUwJqowHlTZyRPIJ2AVK7siXyw9Ncu2Tp8H+N8BevhjNcta5ovA6lPc+ws6tB/zSUV+oc40HLUDHOhnFhstdyVDjZ7Uyb/hVilgzydG/HUtzP6wJ5sXalGuAEqC5LdnT2+crIJwB60NOh1cagshvqEnI=; c=relaxed/relaxed; s=default; d=seu.edu.cn; v=1; bh=cEN3FPmkQR+mfyk0Hh7Q/XQ8BfLjMjCvjCsiEnuYpQ0=; h=date:mime-version:subject:message-id:from; Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=101.71.155.101; envelope-from=getshell@seu.edu.cn; helo=mail-m155101.qiye.163.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Mailman-Approved-At: Fri, 04 Sep 2026 00:32:22 -0400 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @seu.edu.cn) X-ZM-MESSAGEID: 1788496385386158501 Content-Type: text/plain; charset="utf-8" When dump_init() reads the guest VMCOREINFO note and decides the note header is invalid (oversized name/desc or note_size larger than the buffer read from the guest), it frees s->guest_note and sets it to NULL but leaves s->guest_note_size at its previous value. dump_process() later dispatches on the requested format. For DUMP_GUEST_MEMORY_FORMAT_WIN_DMP it calls create_win_dump(), which in dump/win_dump-x86.c dereferences s->guest_note unconditionally: WinDumpHeader *h =3D (void *)(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_S= IZE); so a NULL s->guest_note results in a NULL-pointer dereference (crash / host DoS) instead of the intended clean error. guest_note is only ever non-NULL when guest_note_size was set together with it, so make the two consistent: whenever the note is freed and reset to NULL, also reset guest_note_size to 0, and harden create_win_dump() to reject a missing note before dereferencing it. Signed-off-by: Hongyan Xu Reviewed-by: Marc-Andr=C3=A9 Lureau --- dump/dump.c | 1 + dump/win_dump-x86.c | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/dump/dump.c b/dump/dump.c index 52be7258a5..a2073cea5d 100644 --- a/dump/dump.c +++ b/dump/dump.c @@ -1906,6 +1906,7 @@ static void dump_init(DumpState *s, int fd, bool has_= format, warn_report("Invalid guest note header"); g_free(s->guest_note); s->guest_note =3D NULL; + s->guest_note_size =3D 0; } else { vmcoreinfo_update_phys_base(s); s->note_size +=3D s->guest_note_size; diff --git a/dump/win_dump-x86.c b/dump/win_dump-x86.c index 0dd0c503c5..97c5e3e0da 100644 --- a/dump/win_dump-x86.c +++ b/dump/win_dump-x86.c @@ -445,6 +445,11 @@ bool win_dump_available(Error **errp) =20 void create_win_dump(DumpState *s, Error **errp) { + if (!s->guest_note) { + error_setg(errp, "win-dump: no vmcoreinfo note available"); + return; + } + WinDumpHeader *h =3D (void *)(s->guest_note + VMCOREINFO_ELF_NOTE_HDR_= SIZE); X86CPU *first_x86_cpu =3D X86_CPU(first_cpu); uint64_t saved_cr3 =3D first_x86_cpu->env.cr[3]; --=20 2.50.1.windows.1