On Tue, May 26, 2020 at 9:53 AM P J P <[email protected]> wrote: > > From: Prasad J Pandit <[email protected]> > > When mapping physical memory into host's virtual address space, > 'address_space_map' may return NULL if BounceBuffer is in_use. > Set and return '*plen = 0' to avoid later NULL pointer dereference. > > Reported-by: Alexander Bulekov <[email protected]>
Suggested-by: Paolo Bonzini <[email protected]> > Fixes: https://bugs.launchpad.net/qemu/+bug/1878259 > Signed-off-by: Prasad J Pandit <[email protected]> > --- > exec.c | 1 + > 1 file changed, 1 insertion(+) > > Update v3: set *plen = 0; > -> https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06249.html > > diff --git a/exec.c b/exec.c > index 5162f0d12f..4eea84bf66 100644 > --- a/exec.c > +++ b/exec.c > @@ -3538,6 +3538,7 @@ void *address_space_map(AddressSpace *as, > > if (!memory_access_is_direct(mr, is_write)) { > if (atomic_xchg(&bounce.in_use, true)) { > + *plen = 0; > return NULL; > } > /* Avoid unbounded allocations */ > -- > 2.26.2 >
