[Qemu-devel] [PATCH v2 0/4] pc: Ensure APIC ID limits before aborting or corrupting memory

[Eduardo Habkost <ehabkost@redhat.com>]

This series adds checks for APIC ID limits on initialization and CPU hotplug code.
This fixes multiple issues:

1) Assertion failure when -smp parameter results in a too large APIC ID. e.g.:

    $ ./install/bin/qemu-system-x86_64 -S -smp 254,cores=17,threads=17,sockets=17,maxcpus=254 -nographic
    **
    ERROR:hw/acpi/cpu_hotplug.c:58:AcpiCpuHotplug_init: assertion failed: ((id / 8) < ACPI_GPE_PROC_LEN)
    Aborted (core dumped)

2) Memory corruption on AcpiCpuHotplug_add() when APIC ID is too large (similar
   to the case above, but on CPU hotplug).

3) Out of bounds access on node_cpumask on pc_guest_info_init(), if APIC IDs
   are too large.

Eduardo Habkost (4):
  acpi: Add ACPI_CPU_HOTPLUG_ID_LIMIT macro
  pc: Refuse CPU hotplug if the resulting APIC ID is too large
  acpi: Assert sts array limit on AcpiCpuHotplug_add()
  pc: Refuse max_cpus if it results in too large APIC ID

 hw/acpi/cpu_hotplug.c              |  1 +
 hw/i386/pc.c                       | 17 +++++++++++++++++
 include/hw/acpi/cpu_hotplug_defs.h |  8 ++++++++
 3 files changed, 26 insertions(+)

-- 
1.8.5.3