mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
32a2d6b1f6
qemu/hw
History
Peter Maydell 32a2d6b1f6 hw/i386/amd_iommu.c: Fix corruption of log events passed to guest 
In the function amdvi_log_event(), we write an event log buffer
entry into guest ram, whose contents are passed to the function
via the "uint64_t *evt" argument. Unfortunately, a spurious
'&' in the call to dma_memory_write() meant that instead of
writing the event to the guest we would write the literal value
of the pointer, plus whatever was in the following 8 bytes
on the stack. This error was spotted by Coverity.

Fix the bug by removing the '&'.

Fixes: CID 1421945
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20200326105349.24588-1-peter.maydell@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2020-03-29 09:52:13 -04:00
..
9pfs 9p/proxy: Fix export_flags 2020-03-10 16:12:49 +01:00
acpi acpi: pcihp: fix left shift undefined behavior in acpi_pcihp_eject_slot() 2020-03-29 09:52:13 -04:00
adc
alpha hw/ide: Do ide_drive_get() within pci_ide_create_devs() 2020-03-17 12:22:36 -04:00
arm aspeed/smc: Fix DMA support for AST2600 2020-03-23 17:22:30 +00:00
audio hw/audio/fmopl: fix segmentation fault 2020-03-25 09:55:40 +01:00
block virtio-blk: delete vqs on the error path in realize() 2020-03-29 09:52:13 -04:00
char virtio-serial-bus: Plug memory leak on realize() error paths 2020-03-29 06:33:47 -04:00
core compat: disable edid on correct virtio-gpu device 2020-03-20 07:50:52 +01:00
cpu cpu/arm11mpcore: Set number of GIC priority bits to 4 2020-02-28 16:14:57 +00:00
cris hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
display hw/arm/bcm283x: Correct the license text 2020-03-23 17:22:30 +00:00
dma fdc/i8257: implement verify transfer mode 2020-03-27 14:30:08 -04:00
gpio
hppa hw/ide: Remove unneeded inclusion of hw/ide.h 2020-03-17 12:22:36 -04:00
hyperv
i2c hw/i2c/smbus_ich9: Include "qemu/range.h" 2020-03-09 15:59:31 +01:00
i386 hw/i386/amd_iommu.c: Fix corruption of log events passed to guest 2020-03-29 09:52:13 -04:00
ide cmd646-ide: use qdev gpio rather than qemu_allocate_irqs() 2020-03-27 14:30:08 -04:00
input
intc hw/arm/bcm283x: Correct the license text 2020-03-23 17:22:30 +00:00
ipack
ipmi
isa Pull request 2020-03-19 11:14:24 +00:00
lm32 hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
m68k hw/m68k: Use memory_region_init_rom() with read-only regions 2020-03-17 15:18:47 +01:00
mem spapr: Add NVDIMM device support 2020-02-21 09:15:04 +11:00
microblaze hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
mips hw/ide: Remove unneeded inclusion of hw/ide.h 2020-03-17 12:22:36 -04:00
misc hw/arm/bcm283x: Correct the license text 2020-03-23 17:22:30 +00:00
moxie hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
net * Bugfixes all over the place 2020-03-17 18:33:05 +00:00
nios2 hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
nubus
nvram misc: Replace zero-length arrays with flexible array member (automatic) 2020-03-16 22:07:42 +01:00
openrisc hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
pci pci: Honour wmask when resetting PCI_INTERRUPT_LINE 2020-03-16 21:08:21 -04:00
pci-bridge pcie_root_port: Add hotplug disabling option 2020-03-08 09:18:29 -04:00
pci-host hw/pci-host: Use memory_region_init_rom() with read-only regions 2020-03-17 15:18:47 +01:00
pcmcia
ppc ppc/ppc405_boards: Remove unnecessary NULL check 2020-03-24 11:56:37 +11:00
rdma hw/rdma: avoid suspicious strncpy() use 2020-03-21 19:21:20 +02:00
riscv * Bugfixes all over the place 2020-03-17 18:33:05 +00:00
rtc hw/arm/allwinner: add RTC device support 2020-03-12 16:27:33 +00:00
s390x s390/ipl: fix off-by-one in update_machine_ipl_properties() 2020-03-23 12:36:27 +01:00
scsi hw/scsi/spapr_vscsi: Convert debug fprintf() to trace event 2020-03-17 15:08:50 +11:00
sd hw/sd/ssi-sd: fix error handling in ssi_sd_realize 2020-03-17 17:30:03 +01:00
semihosting
sh4 hw/sh4: Use memory_region_init_rom() with read-only regions 2020-03-17 15:18:47 +01:00
smbios
sparc hw/sparc: Use memory_region_init_rom() with read-only regions 2020-03-17 15:18:48 +01:00
sparc64 hw/ide: Do ide_drive_get() within pci_ide_create_devs() 2020-03-17 12:22:36 -04:00
ssi aspeed/smc: Fix DMA support for AST2600 2020-03-23 17:22:30 +00:00
timer hw/timer/hpet: Include "exec/address-spaces.h" 2020-03-09 15:59:31 +01:00
tpm tpm: Add the SysBus TPM TIS device 2020-03-05 12:18:08 -05:00
tricore hw: Do not initialize MachineClass::is_default to 0 2020-02-28 14:57:19 -05:00
unicore32 hw: Make MachineClass::is_default a boolean type 2020-02-28 14:57:19 -05:00
usb * Bugfixes all over the place 2020-03-17 18:33:05 +00:00
vfio
virtio virtio-iommu: avoid memleak in the unrealize 2020-03-29 09:52:13 -04:00
watchdog
xen misc: Replace zero-length arrays with flexible array member (automatic) 2020-03-16 22:07:42 +01:00
xenpv
xtensa
Kconfig
Makefile.objs