From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:54367) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TasNW-0007wn-KL for qemu-devel@nongnu.org; Tue, 20 Nov 2012 13:17:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TasNV-00015c-8W for qemu-devel@nongnu.org; Tue, 20 Nov 2012 13:16:58 -0500 Received: from 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.d.1.0.0.b.8.0.1.0.0.2.ip6.arpa ([2001:8b0:1d0::1]:40245 helo=mnementh.archaic.org.uk) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TasNV-00015Q-1R for qemu-devel@nongnu.org; Tue, 20 Nov 2012 13:16:57 -0500 From: Peter Maydell Date: Tue, 20 Nov 2012 18:16:51 +0000 Message-Id: <1353435411-24349-1-git-send-email-peter.maydell@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH for-1.3] hw/ide/macio: Fix segfault caused by NULL DMAContext* List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= , Anthony Liguori , Alexander Graf , patches@linaro.org Pass qemu_sglist_init the global dma_context_memory rather than a NULL pointer; this fixes a segfault in dma_memory_map() when the guest starts using DMA. Reported-by: Amadeusz Sławiński Signed-off-by: Peter Maydell --- Test case: download the squeeze standard image from http://people.debian.org/~aurel32/qemu/powerpc/ and run with qemu-system-ppc -hda debian_squeeze_powerpc_standard.qcow2 Without this patch it will crash as soon as Linux tries to talk to the disk (the boot loader is OK as it doesn't DMA). Obvious for-1.3 bugfix. hw/ide/macio.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/ide/macio.c b/hw/ide/macio.c index 720af6e..d2edcc0 100644 --- a/hw/ide/macio.c +++ b/hw/ide/macio.c @@ -76,7 +76,8 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret) s->io_buffer_size = io->len; - qemu_sglist_init(&s->sg, io->len / MACIO_PAGE_SIZE + 1, NULL); + qemu_sglist_init(&s->sg, io->len / MACIO_PAGE_SIZE + 1, + &dma_context_memory); qemu_sglist_add(&s->sg, io->addr, io->len); io->addr += io->len; io->len = 0; @@ -132,7 +133,8 @@ static void pmac_ide_transfer_cb(void *opaque, int ret) s->io_buffer_index = 0; s->io_buffer_size = io->len; - qemu_sglist_init(&s->sg, io->len / MACIO_PAGE_SIZE + 1, NULL); + qemu_sglist_init(&s->sg, io->len / MACIO_PAGE_SIZE + 1, + &dma_context_memory); qemu_sglist_add(&s->sg, io->addr, io->len); io->addr += io->len; io->len = 0; -- 1.7.9.5