hw/arm/ax3000-soc: fix heap overflow from missing class_size

[PATCH] hw/arm/ax3000-soc: fix heap overflow from missing class_size

Doug Cook (WINDOWS) posted 1 patch 1 month, 1 week ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/LVXPR21MB70090B04FF7397B0F2A201C8ADA72@LVXPR21MB7009.namprd21.prod.outlook.com

Maintainers: Kuan-Jui Chiu <kchiu@axiado.com>, Peter Maydell <peter.maydell@linaro.org>

hw/arm/ax3000-soc.c | 1 +
1 file changed, 1 insertion(+)

Expand all Fold all

[PATCH] hw/arm/ax3000-soc: fix heap overflow from missing class_size

Posted by Doug Cook (WINDOWS) 1 month, 1 week ago

TYPE_AX3000_SOC declares an Ax3000SoCClass via OBJECT_DECLARE_TYPE() and
ax3000_class_init() writes to it:

    Ax3000SoCClass *sc = AX3000_SOC_CLASS(oc);
    sc->num_cpus = AX3000_NUM_CPUS;

but its TypeInfo omits .class_size, so type_initialize() only allocates
class_size inherited from the parent, i.e. sizeof(SysBusDeviceClass).
The store to sc->num_cpus therefore writes 4 bytes of the value 4 just
past the end of the class allocation, corrupting whatever heap block
follows it.

Fix by setting class_size.

Fixes: 33a71a68c6e1 ("hw/arm: Add Axiado SoC AX3000")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4197
Signed-off-by: Doug Cook <dcook@microsoft.com>
---
 hw/arm/ax3000-soc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/ax3000-soc.c b/hw/arm/ax3000-soc.c
index 71e31c6fb4..ebe174fb97 100644
--- a/hw/arm/ax3000-soc.c
+++ b/hw/arm/ax3000-soc.c
@@ -236,6 +236,7 @@ static const TypeInfo axiado_soc_types[] = {
         .instance_size  = sizeof(Ax3000SoCState),
         .instance_init  = ax3000_init,
         .class_init     = ax3000_class_init,
+        .class_size     = sizeof(Ax3000SoCClass),
     }
 };
 
-- 
2.55.0.vfs.0.3

Re: [PATCH] hw/arm/ax3000-soc: fix heap overflow from missing class_size

Posted by Peter Maydell 1 month, 1 week ago

On Mon, 17 Aug 2026 at 22:30, Doug Cook (WINDOWS) <dcook@microsoft.com> wrote:
>
> TYPE_AX3000_SOC declares an Ax3000SoCClass via OBJECT_DECLARE_TYPE() and
> ax3000_class_init() writes to it:
>
>     Ax3000SoCClass *sc = AX3000_SOC_CLASS(oc);
>     sc->num_cpus = AX3000_NUM_CPUS;
>
> but its TypeInfo omits .class_size, so type_initialize() only allocates
> class_size inherited from the parent, i.e. sizeof(SysBusDeviceClass).
> The store to sc->num_cpus therefore writes 4 bytes of the value 4 just
> past the end of the class allocation, corrupting whatever heap block
> follows it.
>
> Fix by setting class_size.
>
> Fixes: 33a71a68c6e1 ("hw/arm: Add Axiado SoC AX3000")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4197
> Signed-off-by: Doug Cook <dcook@microsoft.com>
> ---

Applied to target-arm.next, thanks. I took the liberty of fixing
up the Author line to match your Signed-off-by: (i.e. removing
the "(WINDOWS)" tag. Let me know if you'd prefer otherwise.

-- PMM