From: Igor Mammedov Date: Tue, 23 Jul 2019 16:08:59 +0000 (-0400) Subject: pc-dimm: fix crash when invalid slot number is used X-Git-Tag: qemu-xen-4.13.0-rc1~29^2 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=22235bb609c18547cf6b215bad1f9d2ec56ad371;p=qemu-xen.git pc-dimm: fix crash when invalid slot number is used QEMU will crash with: Segmentation fault (core dumped) when negative slot number is used, ex: qemu-system-x86_64 -m 1G,maxmem=20G,slots=256 \ -object memory-backend-ram,id=mem1,size=1G \ -device pc-dimm,id=dimm1,memdev=mem1,slot=-2 fix it by checking that slot number is within valid range. Signed-off-by: Igor Mammedov Message-Id: <20190723160859.27250-1-imammedo@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Reviewed-by: David Gibson Reviewed-by: Li Qiang Signed-off-by: Igor Mammedov <imammedo@redhat.com>

Reviewed-by: Li Qiang <liq3ea@gmail.com>
 
Reviewed-by: Pankaj Gupta --- diff --git a/hw/mem/pc-dimm.c b/hw/mem/pc-dimm.c index b1239fd0d3..29c785799c 100644 --- a/hw/mem/pc-dimm.c +++ b/hw/mem/pc-dimm.c @@ -38,6 +38,13 @@ void pc_dimm_pre_plug(PCDIMMDevice *dimm, MachineState *machine, slot = object_property_get_int(OBJECT(dimm), PC_DIMM_SLOT_PROP, &error_abort); + if ((slot < 0 || slot >= machine->ram_slots) && + slot != PC_DIMM_UNASSIGNED_SLOT) { + error_setg(&local_err, "invalid slot number, valid range is [0-%" + PRIu64 "]", machine->ram_slots - 1); + goto out; + } + slot = pc_dimm_get_free_slot(slot == PC_DIMM_UNASSIGNED_SLOT ? NULL : &slot, machine->ram_slots, &local_err); if (local_err) {