diff options
| author | Igor Mammedov <imammedo@redhat.com> | 2019-07-23 12:08:59 -0400 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2019-07-29 16:57:27 -0400 |
| commit | 22235bb609c18547cf6b215bad1f9d2ec56ad371 (patch) | |
| tree | c4cd927e67a4d2c3b93efbcc9dbc7c0822b9859c /hw/mem | |
| parent | dd56040d297a0c530e204e9f459b256e3ddd7e8f (diff) | |
| download | qemu-22235bb609c18547cf6b215bad1f9d2ec56ad371.zip qemu-22235bb609c18547cf6b215bad1f9d2ec56ad371.tar.gz qemu-22235bb609c18547cf6b215bad1f9d2ec56ad371.tar.bz2 | |
pc-dimm: fix crash when invalid slot number is used
QEMU will crash with:
Segmentation fault (core dumped)
when negative slot number is used, ex:
qemu-system-x86_64 -m 1G,maxmem=20G,slots=256 \
-object memory-backend-ram,id=mem1,size=1G \
-device pc-dimm,id=dimm1,memdev=mem1,slot=-2
fix it by checking that slot number is within valid range.
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20190723160859.27250-1-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Igor Mammedov <<a href="mailto:imammedo@redhat.com" target="_blank">imammedo@redhat.com</a>><br></blockquote><div><br></div><div>Reviewed-by: Li Qiang <<a href="mailto:liq3ea@gmail.com">liq3ea@gmail.com</a>><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Reviewed-by: Pankaj Gupta <pagupta@redhat.com>
Diffstat (limited to 'hw/mem')
| -rw-r--r-- | hw/mem/pc-dimm.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/hw/mem/pc-dimm.c b/hw/mem/pc-dimm.c index b1239fd..29c7857 100644 --- a/hw/mem/pc-dimm.c +++ b/hw/mem/pc-dimm.c @@ -38,6 +38,13 @@ void pc_dimm_pre_plug(PCDIMMDevice *dimm, MachineState *machine, slot = object_property_get_int(OBJECT(dimm), PC_DIMM_SLOT_PROP, &error_abort); + if ((slot < 0 || slot >= machine->ram_slots) && + slot != PC_DIMM_UNASSIGNED_SLOT) { + error_setg(&local_err, "invalid slot number, valid range is [0-%" + PRIu64 "]", machine->ram_slots - 1); + goto out; + } + slot = pc_dimm_get_free_slot(slot == PC_DIMM_UNASSIGNED_SLOT ? NULL : &slot, machine->ram_slots, &local_err); if (local_err) { |