OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
cc941111a5
qemu-e2k/hw/ppc
History
Fabiano Rosas cc941111a5 spapr: fix out of bounds write in spapr_populate_drmem_v2 
buf_len is uint8_t which is not large enough to hold the result of:

  nr_entries * sizeof(struct sPAPRDrconfCellV2) + sizeof(uint32_t);

for a nr_entries greater than 10.

This causes the allocated buffer 'int_buf' to be smaller than expected
and we eventually overwrite some of glibc's control structures (see
"chunk" in https://sourceware.org/glibc/wiki/MallocInternals)

The following error is seen while trying to free int_buf:

  "free(): invalid next size (fast)"

Fixes: a324d6f166 "spapr: Support ibm,dynamic-memory-v2 property"
Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
Message-Id: <20190213172926.21740-1-farosas@linux.ibm.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-02-17 21:54:02 +11:00
..
e500-ccsr.h ppc: do not use ../ in include files 2013-03-01 13:57:33 +01:00
e500.c elf: Add optional function ptr to load_elf() to parse ELF notes 2019-02-05 16:50:16 +01:00
e500.h platform-bus-device: use device plug callback instead of machine_done notifier 2018-05-10 18:10:56 +01:00
e500plat.c hw/ppc: Use the IEC binary prefix definitions 2018-07-02 15:41:16 +02:00
fdt.c target/ppc: Split page size information into a separate allocation 2018-04-27 18:05:22 +10:00
mac_newworld.c mac_newworld: change default NIC to sungem for mac99 machine 2019-02-17 21:54:02 +11:00
mac_oldworld.c elf: Add optional function ptr to load_elf() to parse ELF notes 2019-02-05 16:50:16 +01:00
mac.h macio: move MACIOIDEState type declarations to macio.h 2018-08-30 10:42:18 +10:00
Makefile.objs hw/ppc/Makefile.objs: Build all boards conditinally with CONFIG_* 2019-02-05 16:50:20 +01:00
mpc8544_guts.c shutdown: Add source information to SHUTDOWN and RESET 2017-05-23 13:28:17 +02:00
mpc8544ds.c ppc: e500: switch E500 based machines to full machine definition 2018-04-27 18:05:23 +10:00
pnv_bmc.c Include qapi/error.h exactly where needed 2018-02-09 13:50:17 +01:00
pnv_core.c ppc/pnv: introduce a CPU machine_data 2019-02-04 18:44:18 +11:00
pnv_lpc.c ppc/pnv: check size before data buffer access 2018-11-08 12:04:40 +11:00
pnv_occ.c ppc/pnv: Add OCC model stub with interrupt support 2017-04-26 12:00:42 +10:00
pnv_psi.c pnv/psi: move the ICSState qemu_irq array under the PSI device model 2019-01-09 09:28:14 +11:00
pnv_xscom.c Include qapi/error.h exactly where needed 2018-02-09 13:50:17 +01:00
pnv.c ppc/pnv: introduce a CPU machine_data 2019-02-04 18:44:18 +11:00
ppc4xx_devs.c ppc4xx: Pass array index to function instead of pointer into the array 2019-02-04 18:44:17 +11:00
ppc4xx_pci.c ppc4xx_pci: convert SysBus init method to a realize method 2018-11-08 12:04:40 +11:00
ppc405_boards.c ppc405_boards: use g_new(T, n) instead of g_malloc(sizeof(T) * n) 2018-12-21 09:24:23 +11:00
ppc405_uc.c hw/ppc: Move ppc40x_*reset() functions from ppc405_uc.c to ppc.c 2019-02-04 18:44:18 +11:00
ppc405.h ppc4xx: Export ECB and PLB emulation 2017-09-08 09:30:55 +10:00
ppc440_bamboo.c elf: Add optional function ptr to load_elf() to parse ELF notes 2019-02-05 16:50:16 +01:00
ppc440_pcix.c ppc440_pcix: convert SysBus init method to a realize method 2018-11-08 12:04:40 +11:00
ppc440_uc.c ppc440: Avoid reporting error when reading non-existent RAM slot 2019-02-04 18:44:17 +11:00
ppc440.h ppc440_uc: Basic emulation of PPC440 DMA controller 2018-07-03 09:56:52 +10:00
ppc_booke.c hw/ppc: Don't include m48t59.h if it is not necessary 2019-02-04 18:44:20 +11:00
ppc.c hw/ppc: Don't include m48t59.h if it is not necessary 2019-02-04 18:44:20 +11:00
ppce500_spin.c hw/ppc: Use the IEC binary prefix definitions 2018-07-02 15:41:16 +02:00
prep_systemio.c prep: add PReP System I/O 2017-01-31 10:10:13 +11:00
prep.c hw/ppc/prep: Drop useless inclusion of "hw/i386/pc.h" 2019-02-17 21:54:02 +11:00
rs6000_mc.c hw/ppc: Use the IEC binary prefix definitions 2018-07-02 15:41:16 +02:00
sam460ex.c elf: Add optional function ptr to load_elf() to parse ELF notes 2019-02-05 16:50:16 +01:00
spapr_caps.c ppc/spapr_caps: Add SPAPR_CAP_NESTED_KVM_HV 2018-11-08 13:08:35 +11:00
spapr_cpu_core.c spapr: move the interrupt presenters under machine_data 2019-02-04 18:44:18 +11:00
spapr_drc.c hw/ppc/spapr_drc: Replace error_setg(&error_abort) by error_report() + abort() 2018-06-12 09:33:52 +10:00
spapr_events.c spapr: Rename xics to intc in interrupt controller agnostic code 2019-02-17 21:54:02 +11:00
spapr_hcall.c spapr: introduce a new sPAPR IRQ backend supporting XIVE and XICS 2019-01-09 09:28:14 +11:00
spapr_iommu.c qemu/queue.h: leave head structs anonymous unless necessary 2019-01-11 15:46:55 +01:00
spapr_irq.c spapr: Disallow unsupported kernel-irqchip settings 2019-02-17 21:54:02 +11:00
spapr_ovec.c Purge uses of banned g_assert_FOO() 2018-06-13 13:47:35 +02:00
spapr_pci_vfio.c Include qapi/error.h exactly where needed 2018-02-09 13:50:17 +01:00
spapr_pci.c qdev: pass an Object * to qbus_set_hotplug_handler() 2019-02-17 21:54:02 +11:00
spapr_rng.c hw/ppc/spapr_rng: Introduce CONFIG_SPAPR_RNG switch for spapr_rng.c 2018-11-08 12:04:40 +11:00
spapr_rtas_ddw.c spapr-iommu: Always advertise the maximum possible DMA window size 2018-12-21 09:37:38 +11:00
spapr_rtas.c target/ppc/kvm: set vcpu as online/offline 2018-09-05 16:06:19 +10:00
spapr_rtc.c qapi: Drop qapi_event_send_FOO()'s Error ** argument 2018-08-28 18:21:38 +02:00
spapr_vio.c spapr: Rename xics to intc in interrupt controller agnostic code 2019-02-17 21:54:02 +11:00
spapr.c spapr: fix out of bounds write in spapr_populate_drmem_v2 2019-02-17 21:54:02 +11:00
trace-events ppc/spapr: Receive and store device tree blob from SLOF 2019-01-09 09:28:13 +11:00
virtex_ml507.c elf: Add optional function ptr to load_elf() to parse ELF notes 2019-02-05 16:50:16 +01:00