Commit d9a3b33d authored by Michael S. Tsirkin's avatar Michael S. Tsirkin
Browse files

acpi: fix buffer overrun on migration 



ich calls acpi_gpe_init with length ICH9_PMIO_GPE0_LEN so
ICH9_PMIO_GPE0_LEN/2 bytes are allocated, but then the full
ICH9_PMIO_GPE0_LEN bytes are migrated.

As a quick work-around, allocate twice the memory.
We'll probably want to tweak code to avoid
migrating the extra ICH9_PMIO_GPE0_LEN/2 bytes,
but that is a bit trickier to do without breaking
migration compatibility.

Tested-by: default avatar"Dr. David Alan Gilbert" <dgilbert@redhat.com>
Reported-by: default avatar"Dr. David Alan Gilbert" <dgilbert@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent 48854f57

hw/acpi/core.c

+6 −2
Original line number Diff line number Diff line
@@ -625,8 +625,12 @@ void acpi_pm1_cnt_reset(ACPIREGS *ar) 
void acpi_gpe_init(ACPIREGS *ar, uint8_t len)

{

    ar->gpe.len = len;

    ar->gpe.sts = g_malloc0(len / 2);

    ar->gpe.en = g_malloc0(len / 2);

    /* Only first len / 2 bytes are ever used,

     * but the caller in ich9.c migrates full len bytes.

     * TODO: fix ich9.c and drop the extra allocation.

     */

    ar->gpe.sts = g_malloc0(len);

    ar->gpe.en = g_malloc0(len);

}



void acpi_gpe_reset(ACPIREGS *ar)