From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:49033) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TWWj6-0008Q6-2Z for qemu-devel@nongnu.org; Thu, 08 Nov 2012 13:21:21 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TWWj5-00076v-3h for qemu-devel@nongnu.org; Thu, 08 Nov 2012 13:21:16 -0500 Received: from mx1.redhat.com ([209.132.183.28]:47776) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TWWj4-00076q-P6 for qemu-devel@nongnu.org; Thu, 08 Nov 2012 13:21:15 -0500 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id qA8ILDJB007364 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 8 Nov 2012 13:21:13 -0500 From: Gerd Hoffmann Date: Thu, 8 Nov 2012 19:21:11 +0100 Message-Id: <1352398871-21705-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH] Fix piix4_pm savevm buffer overflow. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann vmstate will read/write 8 bytes for the gpe bits, whereas only two bytes are allocated (and used). So make sure we allocate enougth to not overrun the buffer on savevm and loadvm. Fixing vmstate would probably be better but that has the unpleasent side effect of breaking migration. Signed-off-by: Gerd Hoffmann --- hw/acpi.c | 10 ++++++++-- savevm.c | 6 ++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/hw/acpi.c b/hw/acpi.c index f4aca49..6ed76ff 100644 --- a/hw/acpi.c +++ b/hw/acpi.c @@ -406,9 +406,15 @@ void acpi_pm1_cnt_reset(ACPIREGS *ar) /* ACPI GPE */ void acpi_gpe_init(ACPIREGS *ar, uint8_t len) { + /* + * Hack alert: Although we are using only two bytes (GPE_LEN / 2) + * for each of "sts" and "en" we have to allocate more because + * VMSTATE_GPE_ARRAY() writes 8 bytes (GPE_LEN * sizeof(uint16_t)) + * to the vmstate stream. + */ ar->gpe.len = len; - ar->gpe.sts = g_malloc0(len / 2); - ar->gpe.en = g_malloc0(len / 2); + ar->gpe.sts = g_malloc0(len * 2); + ar->gpe.en = g_malloc0(len * 2); } void acpi_gpe_blk(ACPIREGS *ar, uint32_t blk) diff --git a/savevm.c b/savevm.c index 5d04d59..be0257e 100644 --- a/savevm.c +++ b/savevm.c @@ -1511,6 +1511,8 @@ void vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd, { VMStateField *field = vmsd->fields; + fprintf(stderr, "%s: %s\n", __func__, vmsd->name); + if (vmsd->pre_save) { vmsd->pre_save(opaque); } @@ -1521,6 +1523,8 @@ void vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd, int i, n_elems = 1; int size = field->size; + fprintf(stderr, "%s: %s\n", __func__, field->name); + if (field->flags & VMS_VBUFFER) { size = *(int32_t *)(opaque+field->size_offset); if (field->flags & VMS_MULTIPLY) { @@ -1550,6 +1554,8 @@ void vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd, if (field->flags & VMS_STRUCT) { vmstate_save_state(f, field->vmsd, addr); } else { + fprintf(stderr, "%s: a %p s %d %d/%d\n", __func__, + addr, size, i, n_elems); field->info->put(f, addr, size); } } -- 1.7.1