[PATCH] hw/smbios: fix field corruption in type 4 table

[PATCH] hw/smbios: fix field corruption in type 4 table

[Julia Suvorova]

Since table type 4 of SMBIOS version 2.6 is shorter than 3.0, the
strings which follow immediately after the struct fields have been
overwritten by unconditional filling of later fields such as core_count2.
Make these fields dependent on the SMBIOS version.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2169904

Signed-off-by: Julia Suvorova <jusual@redhat.com>
---
 hw/smbios/smbios.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
index b4243de735..903fd22350 100644
--- a/hw/smbios/smbios.c
+++ b/hw/smbios/smbios.c
@@ -749,14 +749,16 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance)
     t->core_count = (ms->smp.cores > 255) ? 0xFF : ms->smp.cores;
     t->core_enabled = t->core_count;
 
-    t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores);
-
     t->thread_count = (ms->smp.threads > 255) ? 0xFF : ms->smp.threads;
-    t->thread_count2 = cpu_to_le16(ms->smp.threads);
 
     t->processor_characteristics = cpu_to_le16(0x02); /* Unknown */
     t->processor_family2 = cpu_to_le16(0x01); /* Other */
 
+    if (smbios_ep_type == SMBIOS_ENTRY_POINT_TYPE_64) {
+        t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores);
+        t->thread_count2 = cpu_to_le16(ms->smp.threads);
+    }
+
     SMBIOS_BUILD_TABLE_POST;
     smbios_type4_count++;
 }
-- 
2.38.1

Re: [PATCH] hw/smbios: fix field corruption in type 4 table

[Michael S. Tsirkin]

On Wed, Feb 22, 2023 at 10:00:49PM +0100, Julia Suvorova wrote:
> Since table type 4 of SMBIOS version 2.6 is shorter than 3.0, the
> strings which follow immediately after the struct fields have been
> overwritten by unconditional filling of later fields such as core_count2.
> Make these fields dependent on the SMBIOS version.
> 
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2169904

Could you also add a Fixes tag with the commit that introduces the bug?

> 
> Signed-off-by: Julia Suvorova <jusual@redhat.com>
> ---
>  hw/smbios/smbios.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
> index b4243de735..903fd22350 100644
> --- a/hw/smbios/smbios.c
> +++ b/hw/smbios/smbios.c
> @@ -749,14 +749,16 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance)
>      t->core_count = (ms->smp.cores > 255) ? 0xFF : ms->smp.cores;
>      t->core_enabled = t->core_count;
>  
> -    t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores);
> -
>      t->thread_count = (ms->smp.threads > 255) ? 0xFF : ms->smp.threads;
> -    t->thread_count2 = cpu_to_le16(ms->smp.threads);
>  
>      t->processor_characteristics = cpu_to_le16(0x02); /* Unknown */
>      t->processor_family2 = cpu_to_le16(0x01); /* Other */
>  
> +    if (smbios_ep_type == SMBIOS_ENTRY_POINT_TYPE_64) {
> +        t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores);
> +        t->thread_count2 = cpu_to_le16(ms->smp.threads);
> +    }
> +
>      SMBIOS_BUILD_TABLE_POST;
>      smbios_type4_count++;
>  }
> -- 
> 2.38.1

Re: [PATCH] hw/smbios: fix field corruption in type 4 table

[Igor Mammedov]

On Wed, 22 Feb 2023 22:00:49 +0100
Julia Suvorova <jusual@redhat.com> wrote:

> Since table type 4 of SMBIOS version 2.6 is shorter than 3.0, the
> strings which follow immediately after the struct fields have been
> overwritten by unconditional filling of later fields such as core_count2.
> Make these fields dependent on the SMBIOS version.
> 
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2169904
> 
> Signed-off-by: Julia Suvorova <jusual@redhat.com>
> ---
>  hw/smbios/smbios.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
> index b4243de735..903fd22350 100644
> --- a/hw/smbios/smbios.c
> +++ b/hw/smbios/smbios.c
> @@ -749,14 +749,16 @@ static void smbios_build_type_4_table(MachineState *ms, unsigned instance)
>      t->core_count = (ms->smp.cores > 255) ? 0xFF : ms->smp.cores;
>      t->core_enabled = t->core_count;
>  
> -    t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores);
> -
>      t->thread_count = (ms->smp.threads > 255) ? 0xFF : ms->smp.threads;
> -    t->thread_count2 = cpu_to_le16(ms->smp.threads);
>  
>      t->processor_characteristics = cpu_to_le16(0x02); /* Unknown */
>      t->processor_family2 = cpu_to_le16(0x01); /* Other */
>  
> +    if (smbios_ep_type == SMBIOS_ENTRY_POINT_TYPE_64) {
it would be better to use table length as the condition here.

> +        t->core_count2 = t->core_enabled2 = cpu_to_le16(ms->smp.cores);
> +        t->thread_count2 = cpu_to_le16(ms->smp.threads);
> +    }
> +
>      SMBIOS_BUILD_TABLE_POST;
>      smbios_type4_count++;
>  }