mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hostmem: Validate host-nodes before setting bitmap

Browse Source 
host_memory_backend_set_host_nodes() was not validating
host-nodes before writing to backend->host_nodes, making QEMU
write beyond the end of the bitmap.

Fix the crash and add a simple regression test for the fix.

While at it, fix memory leak of the list returned by
visit_type_uint16List().

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <20181130122844.29103-1-ehabkost@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
[ehabkost: removed test case code]
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
This commit is contained in:
Eduardo Habkost 2018-11-30 10:28:44 -02:00
parent aec90730fb
commit ffa144b3af
1 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
backends/hostmem.c
View File

@ -103,14 +103,23 @@ host_memory_backend_set_host_nodes(Object *obj, Visitor *v, const char *name,
{ {
#ifdef CONFIG_NUMA #ifdef CONFIG_NUMA
HostMemoryBackend *backend = MEMORY_BACKEND(obj); HostMemoryBackend *backend = MEMORY_BACKEND(obj);
uint16List *l = NULL; uint16List *l, *host_nodes = NULL;
visit_type_uint16List(v, name, &l, errp); visit_type_uint16List(v, name, &host_nodes, errp);
while (l) { for (l = host_nodes; l; l = l->next) {
bitmap_set(backend->host_nodes, l->value, 1); if (l->value >= MAX_NODES) {
l = l->next; error_setg(errp, "Invalid host-nodes value: %d", l->value);
goto out;
}
} }
for (l = host_nodes; l; l = l->next) {
bitmap_set(backend->host_nodes, l->value, 1);
}
out:
qapi_free_uint16List(host_nodes);
#else #else
error_setg(errp, "NUMA node binding are not supported by this QEMU"); error_setg(errp, "NUMA node binding are not supported by this QEMU");
#endif #endif