OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
90865af7d9
qemu-e2k/hw
History
Xuzhou Cheng 90865af7d9 hw/pci-host: pnv_phb{3, 4}: Fix heap out-of-bound access failure 
pnv_phb3_root_bus_info and pnv_phb4_root_bus_info are missing the
instance_size initialization. This results in accessing out-of-bound
memory when setting 'chip-id' and 'phb-id', and eventually crashes
glib's malloc functionality with the following message:

  "qemu-system-ppc64: GLib: ../glib-2.72.3/glib/gmem.c:131: failed to allocate 3232 bytes"

This issue was noticed only when running qtests with QEMU Windows
32-bit executable. Windows 64-bit, Linux 32/64-bit do not expose
this bug though.

Fixes: 9ae1329ee2 ("ppc/pnv: Add models for POWER8 PHB3 PCIe Host bridge")
Fixes: 4f9924c4d4 ("ppc/pnv: Add models for POWER9 PHB4 PCIe Host bridge")
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Xuzhou Cheng <xuzhou.cheng@windriver.com>
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Message-Id: <20220920103159.1865256-29-bmeng.cn@gmail.com>
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-09-20 12:31:53 -03:00
..
9pfs trivial typos: namesapce 2022-06-28 11:06:44 +02:00
acpi acpi/nvdimm: Define trace events for NVDIMM and substitute nvdimm_debug() 2022-07-26 10:37:46 -04:00
adc hw/adc: Make adci[*] R/W in NPCM7XX ADC 2022-07-18 13:20:14 +01:00
alpha
arm target/arm: Make boards pass base address to armv7m_load_kernel() 2022-09-14 11:19:40 +01:00
audio
avr
block virtio-scsi: fix race in virtio_scsi_dataplane_start() 2022-08-17 07:07:37 -04:00
char
core hw/core: fix platform bus node name 2022-09-07 09:18:33 +02:00
cpu
cris
cxl hw/cxl: Correctly handle variable sized mailbox input payloads. 2022-08-17 13:08:11 -04:00
display xlnx_dp: drop unsupported AUXCommand in xlnx_dp_aux_set_command 2022-08-08 11:40:06 +02:00
dma
gpio hw/gpio/aspeed: Don't let guests modify input pins 2022-07-14 16:24:38 +02:00
hppa lasips2: remove legacy lasips2_initfn() function 2022-07-18 19:28:46 +01:00
hyperv
i2c hw/i2c/pmbus: Add idle state to return 0xff's 2022-07-14 16:24:38 +02:00
i386 util: accept iova_tree_remove_parameter by value 2022-09-02 10:22:39 +08:00
ide block: Change blk_{pread,pwrite}() param order 2022-07-12 12:14:56 +02:00
input pckbd: remove legacy i8042_mm_init() function 2022-07-18 19:28:46 +01:00
intc hw/intc: Move mtimer/mtimecmp to aclint 2022-09-07 09:19:10 +02:00
ipack
ipmi ipmi:smbus: Add a check around a memcpy 2022-08-01 06:40:50 -05:00
isa hw/i386/xen/xen-hvm: Inline xen_piix_pci_write_config_client() and remove it 2022-06-29 00:24:59 +02:00
loongarch hw/loongarch: remove acpi-build.c unused variable 'aml_len' 2022-08-05 10:02:07 -07:00
m68k goldfish_rtc: Add big-endian property 2022-09-04 07:02:56 +01:00
mem
microblaze
mips hw/mips/malta: turn off x86 specific features of PIIX4_PM 2022-08-08 23:23:11 +02:00
misc hw/arm/bcm2835_property: Add support for RPI_FIRMWARE_FRAMEBUFFER_GET_NUM_DISPLAYS 2022-09-14 11:19:39 +01:00
net net: tulip: Restrict DMA engine to memories 2022-09-02 10:22:39 +08:00
nios2 hw/nios2: virt: pass random seed to fdt 2022-07-22 19:01:44 +02:00
nubus
nvme hw/nvme: do not enable ioeventfd by default 2022-08-01 12:01:21 +02:00
nvram block: Change blk_{pread,pwrite}() param order 2022-07-12 12:14:56 +02:00
openrisc hw/openrisc: virt: pass random seed to fdt 2022-09-04 07:02:57 +01:00
pci trivial patches pull request 20220629 2022-06-30 04:49:40 +05:30
pci-bridge
pci-host hw/pci-host: pnv_phb{3, 4}: Fix heap out-of-bound access failure 2022-09-20 12:31:53 -03:00
pcmcia
ppc hw/ppc: spapr: Use qemu_vfree() to free spapr->htab 2022-09-20 12:31:53 -03:00
rdma
remote
riscv hw/riscv: virt: Add PMU DT node to the device tree 2022-09-07 09:19:15 +02:00
rtc goldfish_rtc: Add big-endian property 2022-09-04 07:02:56 +01:00
rx hw/rx: pass random seed to fdt 2022-07-22 19:01:44 +02:00
s390x s390x/cpumodel: add stfl197 processor-activity-instrumentation extension 1 2022-08-25 21:59:04 +02:00
scsi scsi: Reject commands if the CDB length exceeds buf_len 2022-09-01 07:42:37 +02:00
sd block: Change blk_{pread,pwrite}() param order 2022-07-12 12:14:56 +02:00
sensor hw/sensor: Add Renesas ISL69259 device model 2022-07-14 16:24:38 +02:00
sh4
smbios
sparc
sparc64
ssi aspeed/smc: Fix potential overflow 2022-06-30 09:21:13 +02:00
timer hw/intc: Move mtimer/mtimecmp to aclint 2022-09-07 09:19:10 +02:00
tpm tpm_crb: Avoid backend startup just before shutdown under Xen 2022-09-09 17:55:59 -04:00
tricore
usb scsi: Add buf_len parameter to scsi_req_new() 2022-09-01 07:42:37 +02:00
vfio
virtio vdpa: Delete CVQ migration blocker 2022-09-02 10:22:39 +08:00
watchdog ppc/spapr: Implement H_WATCHDOG 2022-07-06 10:22:38 -03:00
xen xen/pass-through: don't create needless register group 2022-07-05 14:19:48 +01:00
xenpv
xtensa
Kconfig
meson.build