From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43516) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V1Sjq-0004dW-37 for qemu-devel@nongnu.org; Mon, 22 Jul 2013 22:54:12 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1V1Sjn-0005ER-BI for qemu-devel@nongnu.org; Mon, 22 Jul 2013 22:54:10 -0400 Received: from cantor2.suse.de ([195.135.220.15]:49745 helo=mx2.suse.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V1Sjn-0005Dz-5T for qemu-devel@nongnu.org; Mon, 22 Jul 2013 22:54:07 -0400 Received: from relay1.suse.de (unknown [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 96629A41E0 for ; Tue, 23 Jul 2013 04:54:06 +0200 (CEST) From: =?UTF-8?q?Andreas=20F=C3=A4rber?= Date: Tue, 23 Jul 2013 04:53:33 +0200 Message-Id: <1374548036-14471-2-git-send-email-afaerber@suse.de> In-Reply-To: <1374548036-14471-1-git-send-email-afaerber@suse.de> References: <1374548036-14471-1-git-send-email-afaerber@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PULL 01/24] gdbstub: Change GDBState::query_cpu to CPUState List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Andreas=20F=C3=A4rber?= Since first_cpu/next_cpu are CPUState, CPUArchState is no longer needed. This resolves a NULL pointer dereference of query_cpu, introduced with commit 182735efaf956ccab50b6d74a4fed163e0f35660 and reported by TeLeMan and Max Filippov. Reviewed-by: Richard Henderson Signed-off-by: Andreas F=C3=A4rber --- gdbstub.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/gdbstub.c b/gdbstub.c index 0ee82a9..bdba19b 100644 --- a/gdbstub.c +++ b/gdbstub.c @@ -289,7 +289,7 @@ enum RSState { typedef struct GDBState { CPUArchState *c_cpu; /* current CPU for step/continue ops */ CPUArchState *g_cpu; /* current CPU for other ops */ - CPUArchState *query_cpu; /* for q{f|s}ThreadInfo */ + CPUState *query_cpu; /* for q{f|s}ThreadInfo */ enum RSState state; /* parsing state */ char line_buf[MAX_PACKET_LENGTH]; int line_buf_index; @@ -2401,15 +2401,14 @@ static int gdb_handle_packet(GDBState *s, const c= har *line_buf) put_packet(s, "QC1"); break; } else if (strcmp(p,"fThreadInfo") =3D=3D 0) { - s->query_cpu =3D first_cpu->env_ptr; + s->query_cpu =3D first_cpu; goto report_cpuinfo; } else if (strcmp(p,"sThreadInfo") =3D=3D 0) { report_cpuinfo: if (s->query_cpu) { - snprintf(buf, sizeof(buf), "m%x", - cpu_index(ENV_GET_CPU(s->query_cpu))); + snprintf(buf, sizeof(buf), "m%x", cpu_index(s->query_cpu= )); put_packet(s, buf); - s->query_cpu =3D ENV_GET_CPU(s->query_cpu)->next_cpu->en= v_ptr; + s->query_cpu =3D s->query_cpu->next_cpu; } else put_packet(s, "l"); break; --=20 1.8.1.4