From 2744bd7eb7955e7ae995a48784760e48c33c1e73 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Wed, 27 Feb 2019 04:54:34 +0000 Subject: [PATCH 2/9] spapr: fix out of bounds write in spapr_populate_drmem_v2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: David Gibson Message-id: <20190227045434.23465-1-dgibson@redhat.com> Patchwork-id: 84720 O-Subject: [RHELAV-8.1 qemu-kvm PATCH] spapr: fix out of bounds write in spapr_populate_drmem_v2 Bugzilla: 1674438 RH-Acked-by: Thomas Huth RH-Acked-by: Serhii Popovych RH-Acked-by: Philippe Mathieu-Daudé From: Fabiano Rosas buf_len is uint8_t which is not large enough to hold the result of: nr_entries * sizeof(struct sPAPRDrconfCellV2) + sizeof(uint32_t); for a nr_entries greater than 10. This causes the allocated buffer 'int_buf' to be smaller than expected and we eventually overwrite some of glibc's control structures (see "chunk" in https://sourceware.org/glibc/wiki/MallocInternals) The following error is seen while trying to free int_buf: "free(): invalid next size (fast)" Fixes: a324d6f166 "spapr: Support ibm,dynamic-memory-v2 property" Signed-off-by: Fabiano Rosas Message-Id: <20190213172926.21740-1-farosas@linux.ibm.com> Reviewed-by: Greg Kurz Signed-off-by: David Gibson (cherry picked from commit cc941111a5bc5f498185fa3824c3b6579c7d45ad) Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1674438 Brew: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=20382722 Branch: rhel8/master-3.1.0 Signed-off-by: David Gibson Signed-off-by: Danilo C. L. de Paula --- hw/ppc/spapr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c index bd2abb7..c1478bf 100644 --- a/hw/ppc/spapr.c +++ b/hw/ppc/spapr.c @@ -688,14 +688,14 @@ static int spapr_populate_drmem_v2(sPAPRMachineState *spapr, void *fdt, int offset, MemoryDeviceInfoList *dimms) { MachineState *machine = MACHINE(spapr); - uint8_t *int_buf, *cur_index, buf_len; + uint8_t *int_buf, *cur_index; int ret; uint64_t lmb_size = SPAPR_MEMORY_BLOCK_SIZE; uint64_t addr, cur_addr, size; uint32_t nr_boot_lmbs = (machine->device_memory->base / lmb_size); uint64_t mem_end = machine->device_memory->base + memory_region_size(&machine->device_memory->mr); - uint32_t node, nr_entries = 0; + uint32_t node, buf_len, nr_entries = 0; sPAPRDRConnector *drc; DrconfCellQueue *elem, *next; MemoryDeviceInfoList *info; -- 1.8.3.1