[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] pc-dimm: fix crash when invalid slot number is used
From: |
Igor Mammedov |
Subject: |
[Qemu-devel] [PATCH] pc-dimm: fix crash when invalid slot number is used |
Date: |
Tue, 23 Jul 2019 12:08:59 -0400 |
QEMU will crash with:
Segmentation fault (core dumped)
when negative slot number is used, ex:
qemu-system-x86_64 -m 1G,maxmem=20G,slots=256 \
-object memory-backend-ram,id=mem1,size=1G \
-device pc-dimm,id=dimm1,memdev=mem1,slot=-2
fix it by checking that slot number is within valid range.
Signed-off-by: Igor Mammedov <address@hidden>
---
hw/mem/pc-dimm.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/mem/pc-dimm.c b/hw/mem/pc-dimm.c
index b1239fd0d3..29c785799c 100644
--- a/hw/mem/pc-dimm.c
+++ b/hw/mem/pc-dimm.c
@@ -38,6 +38,13 @@ void pc_dimm_pre_plug(PCDIMMDevice *dimm, MachineState
*machine,
slot = object_property_get_int(OBJECT(dimm), PC_DIMM_SLOT_PROP,
&error_abort);
+ if ((slot < 0 || slot >= machine->ram_slots) &&
+ slot != PC_DIMM_UNASSIGNED_SLOT) {
+ error_setg(&local_err, "invalid slot number, valid range is [0-%"
+ PRIu64 "]", machine->ram_slots - 1);
+ goto out;
+ }
+
slot = pc_dimm_get_free_slot(slot == PC_DIMM_UNASSIGNED_SLOT ? NULL :
&slot,
machine->ram_slots, &local_err);
if (local_err) {
--
2.18.1
- [Qemu-devel] [PATCH] pc-dimm: fix crash when invalid slot number is used,
Igor Mammedov <=