From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55594) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1c0xbi-0004Tl-FS for qemu-devel@nongnu.org; Sun, 30 Oct 2016 17:25:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1c0xbh-0007Z6-N2 for qemu-devel@nongnu.org; Sun, 30 Oct 2016 17:25:34 -0400 Received: from mx1.redhat.com ([209.132.183.28]:44820) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1c0xbh-0007Yy-HQ for qemu-devel@nongnu.org; Sun, 30 Oct 2016 17:25:33 -0400 Date: Sun, 30 Oct 2016 23:25:30 +0200 From: "Michael S. Tsirkin" Message-ID: <1477850917-1214-48-git-send-email-mst@redhat.com> References: <1477850917-1214-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1477850917-1214-1-git-send-email-mst@redhat.com> Subject: [Qemu-devel] [PULL 47/47] acpi: fix assert failure caused by commit 35c5a52d List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Haozhong Zhang , Dan Williams , Xiao Guangrong , Igor Mammedov From: Haozhong Zhang Commit 35c5a52d "acpi: do not use TARGET_PAGE_SIZE" changed struct NvdimmDsmIn from a variable-size structure to a fixed-size structure of 4096 bytes. It forgot to adjust an assert in nvdimm_dsm_set_label_data(..., NvdimmDsmIn *in, ...): assert(sizeof(*in) + sizeof(*set_label_data) + set_label_data->length <= 4096); which could crash QEMU when guest writes NVDIMM labels. Fix it by replacing sizeof(*in) by offsetof(NvdimmDsmIn, arg3). Signed-off-by: Haozhong Zhang Reported-by: Dan Williams Tested-by: Dan Williams Reviewed-by: Xiao Guangrong Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/acpi/nvdimm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/acpi/nvdimm.c b/hw/acpi/nvdimm.c index fc1a012..602ec54 100644 --- a/hw/acpi/nvdimm.c +++ b/hw/acpi/nvdimm.c @@ -757,8 +757,8 @@ static void nvdimm_dsm_set_label_data(NVDIMMDevice *nvdimm, NvdimmDsmIn *in, return; } - assert(sizeof(*in) + sizeof(*set_label_data) + set_label_data->length <= - 4096); + assert(offsetof(NvdimmDsmIn, arg3) + + sizeof(*set_label_data) + set_label_data->length <= 4096); nvc->write_label_data(nvdimm, set_label_data->in_buf, set_label_data->length, set_label_data->offset); -- MST