On 5/26/20 9:50 AM, P J P wrote: > From: Prasad J Pandit <[email protected]> > > When mapping physical memory into host's virtual address space, > 'address_space_map' may return NULL if BounceBuffer is in_use. > Set and return '*plen = 0' to avoid later NULL pointer dereference. > > Reported-by: Alexander Bulekov <[email protected]> > Fixes: https://bugs.launchpad.net/qemu/+bug/1878259 > Signed-off-by: Prasad J Pandit <[email protected]> > --- > exec.c | 1 + > 1 file changed, 1 insertion(+) > > Update v3: set *plen = 0; > -> https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06249.html > > diff --git a/exec.c b/exec.c > index 5162f0d12f..4eea84bf66 100644 > --- a/exec.c > +++ b/exec.c > @@ -3538,6 +3538,7 @@ void *address_space_map(AddressSpace *as, > > if (!memory_access_is_direct(mr, is_write)) { > if (atomic_xchg(&bounce.in_use, true)) { > + *plen = 0; > return NULL; > } > /* Avoid unbounded allocations */ >
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
