|
 |
51a9cb4 |
From: "Michael S. Tsirkin" <mst@redhat.com>
|
|
|
51a9cb4 |
Date: Thu, 19 Nov 2015 15:14:07 +0200
|
|
|
51a9cb4 |
Subject: [PATCH] acpi: fix buffer overrun on migration
|
|
|
51a9cb4 |
|
|
|
51a9cb4 |
ich calls acpi_gpe_init with length ICH9_PMIO_GPE0_LEN so
|
|
|
51a9cb4 |
ICH9_PMIO_GPE0_LEN/2 bytes are allocated, but then the full
|
|
|
51a9cb4 |
ICH9_PMIO_GPE0_LEN bytes are migrated.
|
|
|
51a9cb4 |
|
|
|
51a9cb4 |
As a quick work-around, allocate twice the memory.
|
|
|
51a9cb4 |
We'll probably want to tweak code to avoid
|
|
|
51a9cb4 |
migrating the extra ICH9_PMIO_GPE0_LEN/2 bytes,
|
|
|
51a9cb4 |
but that is a bit trickier to do without breaking
|
|
|
51a9cb4 |
migration compatibility.
|
|
|
51a9cb4 |
|
|
|
51a9cb4 |
Tested-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
|
|
|
51a9cb4 |
Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
|
|
|
51a9cb4 |
Cc: qemu-stable@nongnu.org
|
|
|
51a9cb4 |
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
|
51a9cb4 |
(cherry picked from commit d9a3b33d2c9f996537b7f1d0246dee2d0120cefb)
|
|
|
51a9cb4 |
---
|
|
|
51a9cb4 |
hw/acpi/core.c | 8 ++++++--
|
|
|
51a9cb4 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
51a9cb4 |
|
|
|
51a9cb4 |
diff --git a/hw/acpi/core.c b/hw/acpi/core.c
|
|
|
51a9cb4 |
index fe6215a..21e113d 100644
|
|
|
51a9cb4 |
--- a/hw/acpi/core.c
|
|
|
51a9cb4 |
+++ b/hw/acpi/core.c
|
|
|
51a9cb4 |
@@ -625,8 +625,12 @@ void acpi_pm1_cnt_reset(ACPIREGS *ar)
|
|
|
51a9cb4 |
void acpi_gpe_init(ACPIREGS *ar, uint8_t len)
|
|
|
51a9cb4 |
{
|
|
|
51a9cb4 |
ar->gpe.len = len;
|
|
|
51a9cb4 |
- ar->gpe.sts = g_malloc0(len / 2);
|
|
|
51a9cb4 |
- ar->gpe.en = g_malloc0(len / 2);
|
|
|
51a9cb4 |
+ /* Only first len / 2 bytes are ever used,
|
|
|
51a9cb4 |
+ * but the caller in ich9.c migrates full len bytes.
|
|
|
51a9cb4 |
+ * TODO: fix ich9.c and drop the extra allocation.
|
|
|
51a9cb4 |
+ */
|
|
|
51a9cb4 |
+ ar->gpe.sts = g_malloc0(len);
|
|
|
51a9cb4 |
+ ar->gpe.en = g_malloc0(len);
|
|
|
51a9cb4 |
}
|
|
|
51a9cb4 |
|
|
|
51a9cb4 |
void acpi_gpe_reset(ACPIREGS *ar)
|