From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53462) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V1GlI-0008S6-Nk for qemu-devel@nongnu.org; Mon, 22 Jul 2013 10:06:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1V1GlH-0001yn-Kq for qemu-devel@nongnu.org; Mon, 22 Jul 2013 10:06:52 -0400 Received: from mx1.redhat.com ([209.132.183.28]:20877) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V1GlH-0001yh-DT for qemu-devel@nongnu.org; Mon, 22 Jul 2013 10:06:51 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r6ME6ou4014624 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 22 Jul 2013 10:06:51 -0400 From: Kevin Wolf Date: Mon, 22 Jul 2013 16:06:39 +0200 Message-Id: <1374502000-25482-2-git-send-email-kwolf@redhat.com> In-Reply-To: <1374502000-25482-1-git-send-email-kwolf@redhat.com> References: <1374502000-25482-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH v2 1/2] exec: Fix bounce buffer allocation in address_space_map() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, pbonzini@redhat.com This fixes a regression introduced by commit e3127ae0c, which kept the allocation size of the bounce buffer limited to one page in order to avoid unbounded allocations (as explained in the commit message of 6d16c2f88), but broke the reporting of the shortened bounce buffer to the caller. The caller therefore assumes that the full requested size was provided and causes memory corruption when writing beyond the end of the actually allocated buffer. Signed-off-by: Kevin Wolf --- exec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/exec.c b/exec.c index c99a883..26aa9e8 100644 --- a/exec.c +++ b/exec.c @@ -2165,7 +2165,9 @@ void *address_space_map(AddressSpace *as, if (bounce.buffer) { return NULL; } - bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE); + /* Avoid unbounded allocations */ + l = MIN(l, TARGET_PAGE_SIZE); + bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, l); bounce.addr = addr; bounce.len = l; -- 1.8.1.4