Re: [Qemu-devel][BUG][PATCH] Fix crash in kvm.c

[Stefan Weil <weil@mail.berlios.de>]

[-- Attachment #1: Type: text/plain, Size: 951 bytes --]

Anthony Liguori schrieb:
> Stefan Weil wrote:
>> Anthony Liguori schrieb:
>>  
>>> Stefan Weil wrote:
>>>    
>>>> I got a crash (array access out of bounds results in access fault)
>>>> with the current Qemu trunk when kvm is enabled:
>>>>
>>>> qemu -fda fd.img -cdrom cdrom.img -hda hda.img -hdb raw.img -m 256
>>>> -boot
>>>> c -enable-kvm
>>>>
>>>> Host is Debian x86_64, the crash occurs before any code is emulated.
>>>>         
>>> Is the patch incomplete, perhaps?  It seems to just add asserts which
>>> shouldn't fix anything.
>>>     
>>
>> The essential change was to replace "int i" by "unsigned i".
>> i = 0x80000000 is negative, so the for loop went until there was an
>> access fault.
>>   
>
> We should change limit too, right?
>
> Regards,
>
> Anthony Liguori
>


Right, and cpuid_i, too. "uint32_t" is even better than "unsigned".
Here is a new patch, now without assertions, so it can be applied to
Qemu trunk.

Regards
Stefan



[-- Attachment #2: kvm.patch --]
[-- Type: text/x-diff, Size: 504 bytes --]

Fix crash with kvm enabled.

Signed-off-by: Stefan Weil <weil@mail.berlios.de> 

Index: target-i386/kvm.c
===================================================================
--- target-i386/kvm.c	(revision 5889)
+++ target-i386/kvm.c	(working copy)
@@ -39,7 +39,7 @@
         struct kvm_cpuid cpuid;
         struct kvm_cpuid_entry entries[100];
     } __attribute__((packed)) cpuid_data;
-    int limit, i, cpuid_i;
+    uint32_t limit, i, cpuid_i;
     uint32_t eax, ebx, ecx, edx;
 
     cpuid_i = 0;