]>
Commit | Line | Data |
---|---|---|
15dc0a5a WB |
1 | From 47568e18c6599962f711bc2ae3cc45fe6900130d Mon Sep 17 00:00:00 2001 |
2 | From: P J P <ppandit@redhat.com> | |
3 | Date: Fri, 18 Dec 2015 11:35:07 +0530 | |
4 | Subject: [PATCH] i386: avoid null pointer dereference | |
5 | ||
6 | Hello, | |
7 | ||
8 | A null pointer dereference issue was reported by Mr Ling Liu, CC'd here. It | |
9 | occurs while doing I/O port write operations via hmp interface. In that, | |
10 | 'current_cpu' remains null as it is not called from cpu_exec loop, which | |
11 | results in the said issue. | |
12 | ||
13 | Below is a proposed (tested)patch to fix this issue; Does it look okay? | |
14 | ||
15 | === | |
16 | From ae88a4947fab9a148cd794f8ad2d812e7f5a1d0f Mon Sep 17 00:00:00 2001 | |
17 | From: Prasad J Pandit <pjp@fedoraproject.org> | |
18 | Date: Fri, 18 Dec 2015 11:16:07 +0530 | |
19 | Subject: [PATCH] i386: avoid null pointer dereference | |
20 | ||
21 | When I/O port write operation is called from hmp interface, | |
22 | 'current_cpu' remains null, as it is not called from cpu_exec() | |
23 | loop. This leads to a null pointer dereference in vapic_write | |
24 | routine. Add check to avoid it. | |
25 | ||
26 | Reported-by: Ling Liu <liuling-it@360.cn> | |
27 | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> | |
28 | Message-Id: <alpine.LFD.2.20.1512181129320.9805@wniryva> | |
29 | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> | |
30 | --- | |
31 | hw/i386/kvmvapic.c | 15 ++++++++++----- | |
32 | 1 file changed, 10 insertions(+), 5 deletions(-) | |
33 | ||
34 | diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c | |
35 | index c6d34b2..f0922da 100644 | |
36 | --- a/hw/i386/kvmvapic.c | |
37 | +++ b/hw/i386/kvmvapic.c | |
38 | @@ -634,13 +634,18 @@ static int vapic_prepare(VAPICROMState *s) | |
39 | static void vapic_write(void *opaque, hwaddr addr, uint64_t data, | |
40 | unsigned int size) | |
41 | { | |
42 | - CPUState *cs = current_cpu; | |
43 | - X86CPU *cpu = X86_CPU(cs); | |
44 | - CPUX86State *env = &cpu->env; | |
45 | - hwaddr rom_paddr; | |
46 | VAPICROMState *s = opaque; | |
47 | + X86CPU *cpu; | |
48 | + CPUX86State *env; | |
49 | + hwaddr rom_paddr; | |
50 | ||
51 | - cpu_synchronize_state(cs); | |
52 | + if (!current_cpu) { | |
53 | + return; | |
54 | + } | |
55 | + | |
56 | + cpu_synchronize_state(current_cpu); | |
57 | + cpu = X86_CPU(current_cpu); | |
58 | + env = &cpu->env; | |
59 | ||
60 | /* | |
61 | * The VAPIC supports two PIO-based hypercalls, both via port 0x7E. | |
62 | -- | |
63 | 2.1.4 | |
64 |