From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54917) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WNntG-0001nm-8c for qemu-devel@nongnu.org; Wed, 12 Mar 2014 14:28:39 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WNntA-0005qR-45 for qemu-devel@nongnu.org; Wed, 12 Mar 2014 14:28:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:6254) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WNnt9-0005ns-Rp for qemu-devel@nongnu.org; Wed, 12 Mar 2014 14:28:24 -0400 From: Eduardo Habkost Date: Wed, 12 Mar 2014 15:28:06 -0300 Message-Id: <1394648890-933-1-git-send-email-ehabkost@redhat.com> Subject: [Qemu-devel] [PATCH v2 0/4] pc: Ensure APIC ID limits before aborting or corrupting memory List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Igor Mammedov , Laszlo Ersek , =?UTF-8?q?Andreas=20F=C3=A4rber?= , "Michael S. Tsirkin" This series adds checks for APIC ID limits on initialization and CPU hotplug code. This fixes multiple issues: 1) Assertion failure when -smp parameter results in a too large APIC ID. e.g.: $ ./install/bin/qemu-system-x86_64 -S -smp 254,cores=17,threads=17,sockets=17,maxcpus=254 -nographic ** ERROR:hw/acpi/cpu_hotplug.c:58:AcpiCpuHotplug_init: assertion failed: ((id / 8) < ACPI_GPE_PROC_LEN) Aborted (core dumped) 2) Memory corruption on AcpiCpuHotplug_add() when APIC ID is too large (similar to the case above, but on CPU hotplug). 3) Out of bounds access on node_cpumask on pc_guest_info_init(), if APIC IDs are too large. Eduardo Habkost (4): acpi: Add ACPI_CPU_HOTPLUG_ID_LIMIT macro pc: Refuse CPU hotplug if the resulting APIC ID is too large acpi: Assert sts array limit on AcpiCpuHotplug_add() pc: Refuse max_cpus if it results in too large APIC ID hw/acpi/cpu_hotplug.c | 1 + hw/i386/pc.c | 17 +++++++++++++++++ include/hw/acpi/cpu_hotplug_defs.h | 8 ++++++++ 3 files changed, 26 insertions(+) -- 1.8.5.3