Re: [Qemu-devel] [PATCH] hostmem: Validate host-nodes before setting bitmap

[Eduardo Habkost]

On Fri, Nov 30, 2018 at 09:32:21AM +0100, Stefano Garzarella wrote:
> On Thu, Nov 29, 2018 at 7:59 PM Eduardo Habkost <address@hidden> wrote:
> >
> > host_memory_backend_set_host_nodes() was not validating
> > host-nodes before writing to backend->host_nodes, making QEMU
> > write beyond the end of the bitmap.
> >
> > Fix the crash and add a simple regression test for the fix.
> >
> > Reported-by: Markus Armbruster <address@hidden>
> > Signed-off-by: Eduardo Habkost <address@hidden>
> > ---
> >  backends/hostmem.c                   | 13 +++++++---
> >  tests/acceptance/host-nodes-limit.py | 36 ++++++++++++++++++++++++++++
> >  2 files changed, 46 insertions(+), 3 deletions(-)
> >  create mode 100644 tests/acceptance/host-nodes-limit.py
> >
> > diff --git a/backends/hostmem.c b/backends/hostmem.c
> > index 1a89342039..ef199d32fd 100644
> > --- a/backends/hostmem.c
> > +++ b/backends/hostmem.c
> > @@ -103,11 +103,18 @@ host_memory_backend_set_host_nodes(Object *obj, 
> > Visitor *v, const char *name,
> >  {
> >  #ifdef CONFIG_NUMA
> >      HostMemoryBackend *backend = MEMORY_BACKEND(obj);
> > -    uint16List *l = NULL;
> > +    uint16List *l, *host_nodes = NULL;
> >
> > -    visit_type_uint16List(v, name, &l, errp);
> > +    visit_type_uint16List(v, name, &host_nodes, errp);
> > +
> > +    for (l = host_nodes; l; l = l->next) {
> > +        if (l->value >= MAX_NODES) {
> > +            error_setg(errp, "Invalid host-nodes value: %d", l->value);
> > +            return;
> > +        }
> > +    }
> >
> > -    while (l) {
> > +    for (l = host_nodes; l; l = l->next) {
> >          bitmap_set(backend->host_nodes, l->value, 1);
> >          l = l->next;
> >      }
> 
> Using the for loop instead of the while, maybe we need to remove the l
> = l->next in the for body.

Yeah, we must remove it.  I did remove it locally but I think I
forgot to amend the commit before submitting.  Thanks for
catching!

-- 
Eduardo