qemu-e2k/include
Greg Kurz 30499fdd98 spapr: Fix buffer overflow in spapr_numa_associativity_init()
Running a guest with 128 NUMA nodes crashes QEMU:

../../util/error.c:59: error_setv: Assertion `*errp == NULL' failed.

The crash happens when setting the FWNMI migration blocker:

2861	    if (spapr_get_cap(spapr, SPAPR_CAP_FWNMI) == SPAPR_CAP_ON) {
2862	        /* Create the error string for live migration blocker */
2863	        error_setg(&spapr->fwnmi_migration_blocker,
2864	            "A machine check is being handled during migration. The handler"
2865	            "may run and log hardware error on the destination");
2866	    }

Inspection reveals that papr->fwnmi_migration_blocker isn't NULL:

(gdb) p spapr->fwnmi_migration_blocker
$1 = (Error *) 0x8000000004000000

Since this is the only place where papr->fwnmi_migration_blocker is
set, this means someone wrote there in our back. Further analysis
points to spapr_numa_associativity_init(), especially the part
that initializes the associative arrays for NVLink GPUs:

    max_nodes_with_gpus = nb_numa_nodes + NVGPU_MAX_NUM;

ie. max_nodes_with_gpus = 128 + 6, but the array isn't sized to
accommodate the 6 extra nodes:

struct SpaprMachineState {
    .
    .
    .
    uint32_t numa_assoc_array[MAX_NODES][NUMA_ASSOC_SIZE];

    Error *fwnmi_migration_blocker;
};

and the following loops happily overwrite spapr->fwnmi_migration_blocker,
and probably more:

    for (i = nb_numa_nodes; i < max_nodes_with_gpus; i++) {
        spapr->numa_assoc_array[i][0] = cpu_to_be32(MAX_DISTANCE_REF_POINTS);

        for (j = 1; j < MAX_DISTANCE_REF_POINTS; j++) {
            uint32_t gpu_assoc = smc->pre_5_1_assoc_refpoints ?
                                 SPAPR_GPU_NUMA_ID : cpu_to_be32(i);
            spapr->numa_assoc_array[i][j] = gpu_assoc;
        }

        spapr->numa_assoc_array[i][MAX_DISTANCE_REF_POINTS] = cpu_to_be32(i);
    }

Fix the size of the array. This requires "hw/ppc/spapr.h" to see
NVGPU_MAX_NUM. Including "hw/pci-host/spapr.h" introduces a
circular dependency that breaks the build, so this moves the
definition of NVGPU_MAX_NUM to "hw/ppc/spapr.h" instead.

Reported-by: Min Deng <mdeng@redhat.com>
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1908693
Fixes: dd7e1d7ae4 ("spapr_numa: move NVLink2 associativity handling to spapr_numa.c")
Cc: danielhb413@gmail.com
Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <160829960428.734871.12634150161215429514.stgit@bahia.lan>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2021-01-06 11:09:59 +11:00
..
authz
block block: introduce BDRV_REQ_NO_WAIT flag 2020-12-18 12:35:55 +01:00
chardev chardev: do not use machine_init_done 2020-12-15 12:51:51 -05:00
crypto
disas
exec tcg: Use memset for large vector byte replication 2021-01-04 06:32:58 -10:00
fpu
hw spapr: Fix buffer overflow in spapr_numa_associativity_init() 2021-01-06 11:09:59 +11:00
io
libdecnumber
migration migration: Replace migration's JSON writer by the general one 2020-12-19 10:39:16 +01:00
monitor sev: add sev-inject-launch-secret 2020-12-10 17:33:17 -05:00
net qdev: Move softmmu properties to qdev-properties-system.h 2020-12-18 15:20:17 -05:00
qapi qobject: Make QString immutable 2020-12-19 10:39:41 +01:00
qemu QAPI patches patches for 2020-12-19 2021-01-01 14:33:03 +00:00
qom
scsi
standard-headers target/i386: Support up to 32768 CPUs without IRQ remapping 2020-12-10 12:15:00 -05:00
sysemu vl: Add option to avoid stopping VM upon guest panic 2020-12-15 12:51:58 -05:00
tcg tcg: Add tcg_gen_bswap_tl alias 2021-01-04 06:32:58 -10:00
ui console: drop qemu_console_get_ui_info 2020-12-11 08:06:39 +01:00
user
elf.h
glib-compat.h
qemu-common.h vl: extract softmmu/datadir.c 2020-12-10 12:15:18 -05:00
qemu-io.h
trace-tcg.h