diff mbox series

[1/4] cxl/type3: Fix crash in set_cacheline()

Message ID 20230908073152.4386-2-dave@stgolabs.net
State New, archived
Headers show
Series hw/cxl: Support for scan media | expand

Commit Message

Davidlohr Bueso Sept. 8, 2023, 7:31 a.m. UTC
Use the correct vmr_size, otherwise a clear poison operation, for
example, can crash the emulator.

Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
---
 hw/mem/cxl_type3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Fan Ni Sept. 8, 2023, 6:37 p.m. UTC | #1
On Fri, Sep 08, 2023 at 12:31:49AM -0700, Davidlohr Bueso wrote:
> Use the correct vmr_size, otherwise a clear poison operation, for
> example, can crash the emulator.
>
> Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
> ---
>  hw/mem/cxl_type3.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
> index fd9d134d468f..b90a7397d62f 100644
> --- a/hw/mem/cxl_type3.c
> +++ b/hw/mem/cxl_type3.c
> @@ -1417,7 +1417,7 @@ static bool set_cacheline(CXLType3Dev *ct3d, uint64_t dpa_offset, uint8_t *data)
>          as = &ct3d->hostvmem_as;
>      } else if (dpa_offset < vmr_size + pmr_size) {
>          as = &ct3d->hostpmem_as;
> -        dpa_offset -= vmr->size;
> +        dpa_offset -= vmr_size;

Good catch. It is a typo from my DCD patch, not upstreamed yet.

Fan
>      } else {
>          as = &ct3d->dc.host_dc_as;
>          dpa_offset -= (vmr_size + pmr_size);
> --
> 2.42.0
>
Jonathan Cameron Sept. 12, 2023, 10:59 a.m. UTC | #2
On Fri, 8 Sep 2023 11:37:31 -0700
Fan Ni <fan.ni@gmx.us> wrote:

> On Fri, Sep 08, 2023 at 12:31:49AM -0700, Davidlohr Bueso wrote:
> > Use the correct vmr_size, otherwise a clear poison operation, for
> > example, can crash the emulator.
> >
> > Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
> > ---
> >  hw/mem/cxl_type3.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
> > index fd9d134d468f..b90a7397d62f 100644
> > --- a/hw/mem/cxl_type3.c
> > +++ b/hw/mem/cxl_type3.c
> > @@ -1417,7 +1417,7 @@ static bool set_cacheline(CXLType3Dev *ct3d, uint64_t dpa_offset, uint8_t *data)
> >          as = &ct3d->hostvmem_as;
> >      } else if (dpa_offset < vmr_size + pmr_size) {
> >          as = &ct3d->hostpmem_as;
> > -        dpa_offset -= vmr->size;
> > +        dpa_offset -= vmr_size;  
> 
> Good catch. It is a typo from my DCD patch, not upstreamed yet.
In meantime I squish this into the version of your series I'm carrying and
push out a new tree later today.

Thanks,

Jonathan

> 
> Fan
> >      } else {
> >          as = &ct3d->dc.host_dc_as;
> >          dpa_offset -= (vmr_size + pmr_size);
> > --
> > 2.42.0
> >
diff mbox series

Patch

diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index fd9d134d468f..b90a7397d62f 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1417,7 +1417,7 @@  static bool set_cacheline(CXLType3Dev *ct3d, uint64_t dpa_offset, uint8_t *data)
         as = &ct3d->hostvmem_as;
     } else if (dpa_offset < vmr_size + pmr_size) {
         as = &ct3d->hostpmem_as;
-        dpa_offset -= vmr->size;
+        dpa_offset -= vmr_size;
     } else {
         as = &ct3d->dc.host_dc_as;
         dpa_offset -= (vmr_size + pmr_size);