From: Paolo Bonzini <pbonzini@redhat.com>
To: qemu-devel@nongnu.org
Cc: Prasad J Pandit <pjp@fedoraproject.org>, qemu-stable@nongnu.org
Subject: [Qemu-devel] [PULL 03/24] i386: kvmvapic: initialise imm32 variable
Date: Mon, 23 May 2016 17:09:38 +0200 [thread overview]
Message-ID: <1464016199-43768-4-git-send-email-pbonzini@redhat.com> (raw)
In-Reply-To: <1464016199-43768-1-git-send-email-pbonzini@redhat.com>
From: Prasad J Pandit <pjp@fedoraproject.org>
When processing Task Priorty Register(TPR) access, it could leak
automatic stack variable 'imm32' in patch_instruction().
Initialise the variable to avoid it.
Reported by: Donghai Zdh <donghai.zdh@alibaba-inc.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <1460013608-16670-1-git-send-email-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
hw/i386/kvmvapic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c
index 8fd27ba..5b71b1b 100644
--- a/hw/i386/kvmvapic.c
+++ b/hw/i386/kvmvapic.c
@@ -397,7 +397,7 @@ static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip)
CPUX86State *env = &cpu->env;
VAPICHandlers *handlers;
uint8_t opcode[2];
- uint32_t imm32;
+ uint32_t imm32 = 0;
target_ulong current_pc = 0;
target_ulong current_cs_base = 0;
uint32_t current_flags = 0;
--
1.8.3.1
next prev parent reply other threads:[~2016-05-23 15:10 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-23 15:09 [Qemu-devel] [PULL 00/24] Misc patches for 2016-05-23 Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 01/24] exec.c: Ensure right alignment also for file backed ram Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 02/24] docs/atomics.txt: Update pointer to linux macro Paolo Bonzini
2016-05-23 15:09 ` Paolo Bonzini [this message]
2016-05-23 15:09 ` [Qemu-devel] [PULL 04/24] configure: Allow builds with extra warnings Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 05/24] target-i386: key sfence availability on CPUID_SSE, not CPUID_SSE2 Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 06/24] ioapic: keep RO bits for IOAPIC entry Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 07/24] ioapic: clear remote irr bit for edge-triggered interrupts Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 08/24] vl: change runstate only if new state is different from current state Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 09/24] memory: drop find_ram_block() Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 10/24] exec: adjust rcu_read_lock requirement Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 11/24] memory: Remove code for mr->may_overlap Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 12/24] memory: Drop FlatRange.romd_mode Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 13/24] memory: remove unnecessary masking of MemoryRegion ram_addr Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 14/24] cpus.c: Use pthread_sigmask() rather than sigprocmask() Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 15/24] Remove config-devices.mak on 'make clean' Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 16/24] scripts/signrom.py: Allow option ROM checksum script to write the size header Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 17/24] scripts/signrom.py: Check for magic in option ROMs Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 18/24] esp: check command buffer length before write(CVE-2016-4439) Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 19/24] esp: check dma length before reading scsi command(CVE-2016-4441) Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 20/24] iscsi: pass SCSI status back for SG_IO Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 21/24] coccinelle: add g_assert_cmp* to macro file Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 22/24] target-i386: add a generic x86 nmi handler Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 23/24] nmi: remove x86 specific nmi handling Paolo Bonzini
2016-05-23 15:09 ` [Qemu-devel] [PULL 24/24] cpus: call the core nmi injection function Paolo Bonzini
2016-05-23 16:16 ` [Qemu-devel] [PULL 00/24] Misc patches for 2016-05-23 Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1464016199-43768-4-git-send-email-pbonzini@redhat.com \
--to=pbonzini@redhat.com \
--cc=pjp@fedoraproject.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).