Commit a1a9d6f9 authored by Prasad J Pandit's avatar Prasad J Pandit Committed by zhanghailiang
Browse files

exec: set map length to zero when returning NULL 



When mapping physical memory into host's virtual address space,
'address_space_map' may return NULL if BounceBuffer is in_use.
Set and return '*plen = 0' to avoid later NULL pointer dereference.

Reported-by: default avatarAlexander Bulekov <alxndr@bu.edu>
Fixes: https://bugs.launchpad.net/qemu/+bug/1878259


Suggested-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Suggested-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20200526111743.428367-1-ppandit@redhat.com>
Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 22bbf1a9

exec.c

+1 −0
Original line number Diff line number Diff line
@@ -3739,6 +3739,7 @@ void *address_space_map(AddressSpace *as, 
    if (!memory_access_is_direct(mr, is_write)) {

        if (atomic_xchg(&bounce.in_use, true)) {

            rcu_read_unlock();

            *plen = 0;

            return NULL;

        }

        /* Avoid unbounded allocations */

include/exec/memory.h

+2 −1
Original line number Diff line number Diff line
@@ -2064,7 +2064,8 @@ bool address_space_access_valid(AddressSpace *as, hwaddr addr, hwaddr len, 
/* address_space_map: map a physical memory region into a host virtual address

 *

 * May map a subset of the requested range, given by and returned in @plen.

 * May return %NULL if resources needed to perform the mapping are exhausted.

 * May return %NULL and set *@plen to zero(0), if resources needed to perform

 * the mapping are exhausted.

 * Use only for reads OR writes - not for read-modify-write operations.

 * Use cpu_register_map_client() to know when retrying the map operation is

 * likely to succeed.