diff mbox

memory: fix segv on qemu_ram_free(block=0x0)

Message ID 1459250451-29984-1-git-send-email-marcandre.lureau@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Marc-André Lureau March 29, 2016, 11:20 a.m. UTC 
From: Marc-André Lureau <marcandre.lureau@redhat.com>

Since f1060c55bf1377b4, the pointer is directly passed to
qemu_ram_free(). However, on initialization failure, it may be called
with a NULL pointer. Return immediately in this case.

This fixes a SEGV when memory initialization failed, for example
permission denied on open backing store /dev/hugepages, with -object
memory-backend-file,mem-path=/dev/hugepages.

Program received signal SIGSEGV, Segmentation fault.
0x00005555556e67e7 in qemu_ram_free (block=0x0) at /home/elmarco/src/qemu/exec.c:1775

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 exec.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Paolo Bonzini March 29, 2016, 11:27 a.m. UTC | #1 
On 29/03/2016 13:20, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> Since f1060c55bf1377b4, the pointer is directly passed to
> qemu_ram_free(). However, on initialization failure, it may be called
> with a NULL pointer. Return immediately in this case.
> 
> This fixes a SEGV when memory initialization failed, for example
> permission denied on open backing store /dev/hugepages, with -object
> memory-backend-file,mem-path=/dev/hugepages.
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x00005555556e67e7 in qemu_ram_free (block=0x0) at /home/elmarco/src/qemu/exec.c:1775
> 
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Looks good, thanks!  I'll push it during hard freeze.

Paolo
diff mbox

Patch

diff --git a/exec.c b/exec.c
index f398d21..965f3b2 100644
--- a/exec.c
+++ b/exec.c
@@ -1771,6 +1771,10 @@  static void reclaim_ramblock(RAMBlock *block)
 
 void qemu_ram_free(RAMBlock *block)
 {
+    if (!block) {
+        return;
+    }
+
     qemu_mutex_lock_ramlist();
     QLIST_REMOVE_RCU(block, next);
     ram_list.mru_block = NULL;