diff options
| author | David Gibson <david@gibson.dropbear.id.au> | 2016-08-08 10:06:25 +1000 |
|---|---|---|
| committer | David Gibson <david@gibson.dropbear.id.au> | 2016-08-08 10:06:25 +1000 |
| commit | 57c0eb1e0d6d8f01550d10cf08747f25cd537777 (patch) | |
| tree | dca68aefc864954a3429af532d126d9d8430a9f2 /hw/ppc/spapr_iommu.c | |
| parent | 16275edb342342625cd7e7ac2048436474465b50 (diff) | |
| download | qemu-57c0eb1e0d6d8f01550d10cf08747f25cd537777.zip qemu-57c0eb1e0d6d8f01550d10cf08747f25cd537777.tar.gz qemu-57c0eb1e0d6d8f01550d10cf08747f25cd537777.tar.bz2 | |
spapr: Fix undefined behaviour in spapr_tce_reset()
When a TCE table (sPAPR IOMMU context) is in disabled state (which is true
by default for the 64-bit window), it has tcet->nb_table == 0 and
tcet->table == NULL. However, on system reset, spapr_tce_reset() executes,
which unconditionally calls
memset(tcet->table, 0, table_size);
We get away with this in practice, because it's a zero length memset(),
but memset() on a NULL pointer is undefined behaviour, so we should not
call it in this case.
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Diffstat (limited to 'hw/ppc/spapr_iommu.c')
| -rw-r--r-- | hw/ppc/spapr_iommu.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c index d57b05d..6bc4d4d 100644 --- a/hw/ppc/spapr_iommu.c +++ b/hw/ppc/spapr_iommu.c @@ -385,7 +385,9 @@ static void spapr_tce_reset(DeviceState *dev) sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev); size_t table_size = tcet->nb_table * sizeof(uint64_t); - memset(tcet->table, 0, table_size); + if (tcet->nb_table) { + memset(tcet->table, 0, table_size); + } } static target_ulong put_tce_emu(sPAPRTCETable *tcet, target_ulong ioba, |