Re: [Qemu-devel] [PATCH] [M25P80] Make sure not to overrun the internal data buffer.

[Jean-Christophe DUBOIS]

Le 24/12/2016 à 18:18, mar.krzeminski a écrit :
> Hello,
>
> W dniu 24.12.2016 o 16:11, Jean-Christophe Dubois pisze:
> > It did happen that the internal data buffer was overrun leading to a 
> > Qemu
> > crash (in particular while emulating the i.MX6 sabrelite board).
> >
> > This patch makes sure the data array would not be overrun and allow the
> > sabrelite emulation to run without crash.
> >
> > Signed-off-by: Jean-Christophe Dubois <address@hidden>
> > ---
> >   hw/block/m25p80.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
> > index d29ff4c..a1c4e5d 100644
> > --- a/hw/block/m25p80.c
> > +++ b/hw/block/m25p80.c
> > @@ -1117,7 +1117,7 @@ static uint32_t m25p80_transfer8(SSISlave *ss, 
> > uint32_t tx)
> >           s->data[s->len] = (uint8_t)tx;
> >           s->len++;
> >   -        if (s->len == s->needed_bytes) {
> > +        if ((s->len >= s->needed_bytes) || (s->len >= 
> > sizeof(s->data))) {
> >               complete_collecting_data(s);
> >           }
> >           break;
> Do you have exact scenario that caused the problem?

When booting Xvisor (http://xhypervisor.org/) on top of Qemu emulated 
Sabrelite.

During the boot Qemu would segfault while writing to the SPI flash.

> Generally it should not happen.

The fact is that there is no protection to make sure the data array is 
not overrun.

May be it should not happen but it did happen in this case ....

JC


> Thanks,
> Marcin