From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50932) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZJz4a-00066D-UO for qemu-devel@nongnu.org; Tue, 28 Jul 2015 03:13:16 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZJz4Z-0001NM-TY for qemu-devel@nongnu.org; Tue, 28 Jul 2015 03:13:12 -0400 Received: from mail-wi0-x22b.google.com ([2a00:1450:400c:c05::22b]:33640) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZJz4Z-0001N4-MS for qemu-devel@nongnu.org; Tue, 28 Jul 2015 03:13:11 -0400 Received: by wicmv11 with SMTP id mv11so166742445wic.0 for ; Tue, 28 Jul 2015 00:13:11 -0700 (PDT) From: =?UTF-8?q?Salva=20Peir=C3=B3?= Date: Tue, 28 Jul 2015 09:13:20 +0200 Message-Id: <1438067600-8468-2-git-send-email-speirofr@gmail.com> In-Reply-To: <1438067600-8468-1-git-send-email-speirofr@gmail.com> References: <1438067600-8468-1-git-send-email-speirofr@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH] memory: Add function pointers checks to memory_region_read/write() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paolo Bonzini Cc: qemu-devel@nongnu.org, =?UTF-8?q?Salva=20Peir=C3=B3?= The memory.c file directly calls the function pointers provided in the MemoryRegionOps to handle read and write operations for memory regions. The function pointers are called without checking if the function pointers are initialised, therefore, leading to QEMU SIGSEGV when the operations are not initialised. The patch adds explicit checks to function pointers before issuing the calls. Signed-off-by: Salva Peiró --- memory.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/memory.c b/memory.c index 5e5f325..d588c5f 100644 --- a/memory.c +++ b/memory.c @@ -380,6 +380,9 @@ static MemTxResult memory_region_oldmmio_read_accessor(MemoryRegion *mr, { uint64_t tmp; + if (!mr->ops->old_mmio.read) { + return MEMTX_ERROR; + } tmp = mr->ops->old_mmio.read[ctz32(size)](mr->opaque, addr); trace_memory_region_ops_read(mr, addr, tmp, size); *value |= (tmp & mask) << shift; @@ -396,6 +399,9 @@ static MemTxResult memory_region_read_accessor(MemoryRegion *mr, { uint64_t tmp; + if (!mr->ops->read) { + return MEMTX_ERROR; + } tmp = mr->ops->read(mr->opaque, addr, size); trace_memory_region_ops_read(mr, addr, tmp, size); *value |= (tmp & mask) << shift; @@ -413,6 +419,9 @@ static MemTxResult memory_region_read_with_attrs_accessor(MemoryRegion *mr, uint64_t tmp = 0; MemTxResult r; + if (!mr->ops->read_with_attrs) { + return MEMTX_ERROR; + } r = mr->ops->read_with_attrs(mr->opaque, addr, &tmp, size, attrs); trace_memory_region_ops_read(mr, addr, tmp, size); *value |= (tmp & mask) << shift; @@ -429,6 +438,9 @@ static MemTxResult memory_region_oldmmio_write_accessor(MemoryRegion *mr, { uint64_t tmp; + if (!mr->ops->old_mmio.write) { + return MEMTX_ERROR; + } tmp = (*value >> shift) & mask; trace_memory_region_ops_write(mr, addr, tmp, size); mr->ops->old_mmio.write[ctz32(size)](mr->opaque, addr, tmp); @@ -447,6 +459,9 @@ static MemTxResult memory_region_write_accessor(MemoryRegion *mr, tmp = (*value >> shift) & mask; trace_memory_region_ops_write(mr, addr, tmp, size); + if (!mr->ops->write) { + return MEMTX_ERROR; + } mr->ops->write(mr->opaque, addr, tmp, size); return MEMTX_OK; } @@ -463,6 +478,9 @@ static MemTxResult memory_region_write_with_attrs_accessor(MemoryRegion *mr, tmp = (*value >> shift) & mask; trace_memory_region_ops_write(mr, addr, tmp, size); + if (!mr->ops->write_with_attrs) { + return MEMTX_ERROR; + } return mr->ops->write_with_attrs(mr->opaque, addr, tmp, size, attrs); } @@ -1187,6 +1205,8 @@ void memory_region_init_io(MemoryRegion *mr, uint64_t size) { memory_region_init(mr, owner, name, size); + assert(ops != NULL); + mr->ops = ops; mr->opaque = opaque; mr->terminates = true; -- 2.1.4