[Qemu-devel][BUG][PATCH] Fix crash in kvm.c

[Stefan Weil <weil@mail.berlios.de>]

[-- Attachment #1: Type: text/plain, Size: 485 bytes --]

I got a crash (array access out of bounds results in access fault)
with the current Qemu trunk when kvm is enabled:

qemu -fda fd.img -cdrom cdrom.img -hda hda.img -hdb raw.img -m 256 -boot
c -enable-kvm

Host is Debian x86_64, the crash occurs before any code is emulated.

With the patch, the emulation (Win 98) boots, but has problems with the
display of
icons and the mouse cursor. Qemu displays lots of
"BUG: kvm_physical_sync_dirty_bitmap: invalid parameters" messages.

Stefan


[-- Attachment #2: kvm.patch --]
[-- Type: text/x-diff, Size: 1125 bytes --]

Fix crash with kvm enabled.

Signed-off-by: Stefan Weil <weil@mail.berlios.de> 

Index: target-i386/kvm.c
===================================================================
--- target-i386/kvm.c	(Revision 5889)
+++ target-i386/kvm.c	(Arbeitskopie)
@@ -12,6 +12,7 @@
  *
  */
 
+#include <assert.h>
 #include <sys/types.h>
 #include <sys/ioctl.h>
 #include <sys/mman.h>
@@ -39,7 +40,8 @@
         struct kvm_cpuid cpuid;
         struct kvm_cpuid_entry entries[100];
     } __attribute__((packed)) cpuid_data;
-    int limit, i, cpuid_i;
+    int limit, cpuid_i;
+    unsigned i;
     uint32_t eax, ebx, ecx, edx;
 
     cpuid_i = 0;
@@ -49,6 +51,7 @@
 
     for (i = 0; i <= limit; i++) {
         struct kvm_cpuid_entry *c = &cpuid_data.entries[cpuid_i++];
+        assert(cpuid_i < 100);
 
         cpu_x86_cpuid(env, i, &eax, &ebx, &ecx, &edx);
         c->function = i;
@@ -63,6 +66,7 @@
 
     for (i = 0x80000000; i <= limit; i++) {
         struct kvm_cpuid_entry *c = &cpuid_data.entries[cpuid_i++];
+        assert(cpuid_i < 100);
 
         cpu_x86_cpuid(env, i, &eax, &ebx, &ecx, &edx);
         c->function = i;