From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46524) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V1FTE-00059j-VL for qemu-devel@nongnu.org; Mon, 22 Jul 2013 08:44:10 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1V1FTD-0002mi-Ax for qemu-devel@nongnu.org; Mon, 22 Jul 2013 08:44:08 -0400 Received: from mx1.redhat.com ([209.132.183.28]:46024) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V1FTD-0002mP-2T for qemu-devel@nongnu.org; Mon, 22 Jul 2013 08:44:07 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r6MCi6Jx012218 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 22 Jul 2013 08:44:06 -0400 From: Kevin Wolf Date: Mon, 22 Jul 2013 14:43:57 +0200 Message-Id: <1374497038-22136-2-git-send-email-kwolf@redhat.com> In-Reply-To: <1374497038-22136-1-git-send-email-kwolf@redhat.com> References: <1374497038-22136-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH 1/2] exec: Fix bounce buffer allocation in address_space_map() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, pbonzini@redhat.com This fixes a regression introduced by commit e3127ae0c, which kept the allocation size of the bounce buffer limited to one page in order to avoid unbounded allocations (as explained in the commit message of 6d16c2f88), but broke the reporting of the shortened bounce buffer to the caller. The caller therefore assumes that the full requested size was provided and causes memory corruption when writing beyond the end of the actually allocated buffer. Signed-off-by: Kevin Wolf --- exec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/exec.c b/exec.c index c99a883..53cbbdf 100644 --- a/exec.c +++ b/exec.c @@ -2165,7 +2165,9 @@ void *address_space_map(AddressSpace *as, if (bounce.buffer) { return NULL; } - bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE); + /* Avoid unbounded allocations */ + l = TARGET_PAGE_SIZE; + bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, l); bounce.addr = addr; bounce.len = l; -- 1.8.1.4