mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 01:43:39 +00:00
hostmem: Validate host-nodes before setting bitmap
host_memory_backend_set_host_nodes() was not validating host-nodes before writing to backend->host_nodes, making QEMU write beyond the end of the bitmap. Fix the crash and add a simple regression test for the fix. While at it, fix memory leak of the list returned by visit_type_uint16List(). Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Message-Id: <20181130122844.29103-1-ehabkost@redhat.com> Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com> Reviewed-by: Igor Mammedov <imammedo@redhat.com> [ehabkost: removed test case code] Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
This commit is contained in:
parent
aec90730fb
commit
ffa144b3af
|
@ -103,14 +103,23 @@ host_memory_backend_set_host_nodes(Object *obj, Visitor *v, const char *name,
|
||||||
{
|
{
|
||||||
#ifdef CONFIG_NUMA
|
#ifdef CONFIG_NUMA
|
||||||
HostMemoryBackend *backend = MEMORY_BACKEND(obj);
|
HostMemoryBackend *backend = MEMORY_BACKEND(obj);
|
||||||
uint16List *l = NULL;
|
uint16List *l, *host_nodes = NULL;
|
||||||
|
|
||||||
visit_type_uint16List(v, name, &l, errp);
|
visit_type_uint16List(v, name, &host_nodes, errp);
|
||||||
|
|
||||||
while (l) {
|
for (l = host_nodes; l; l = l->next) {
|
||||||
bitmap_set(backend->host_nodes, l->value, 1);
|
if (l->value >= MAX_NODES) {
|
||||||
l = l->next;
|
error_setg(errp, "Invalid host-nodes value: %d", l->value);
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
for (l = host_nodes; l; l = l->next) {
|
||||||
|
bitmap_set(backend->host_nodes, l->value, 1);
|
||||||
|
}
|
||||||
|
|
||||||
|
out:
|
||||||
|
qapi_free_uint16List(host_nodes);
|
||||||
#else
|
#else
|
||||||
error_setg(errp, "NUMA node binding are not supported by this QEMU");
|
error_setg(errp, "NUMA node binding are not supported by this QEMU");
|
||||||
#endif
|
#endif
|
||||||
|
|
Loading…
Reference in a new issue