diff options
| author | Greg Kurz <groug@kaod.org> | 2016-07-08 15:12:07 +0200 |
|---|---|---|
| committer | David Gibson <david@gibson.dropbear.id.au> | 2016-07-18 10:40:27 +1000 |
| commit | 44d691f7d9b6ebab102a31aa87fe59da8f7feff9 (patch) | |
| tree | 02579e19fe93c152a533c6438d06040326b922a9 /hw/misc/macio/mac_dbdma.c | |
| parent | 6b92bbfe812746fe7841a24c24e6460f5359ce72 (diff) | |
| download | focaccia-qemu-44d691f7d9b6ebab102a31aa87fe59da8f7feff9.tar.gz focaccia-qemu-44d691f7d9b6ebab102a31aa87fe59da8f7feff9.zip | |
spapr: fix core unplug crash
If the host has 8 threads/core and the guest is started with: -smp cores=1,threads=4,maxcpus=12 It is possible to crash QEMU by doing: (qemu) device_add host-spapr-cpu-core,core-id=16,id=foo (qemu) device_del foo Segmentation fault This happens because spapr_core_unplug() assumes cpu_dt_id == core_id. As long as cpu_dt_id is derived from the non-table cpu_index, this is only true when you plug cores with contiguous ids. It is safer to be consistent: the DR connector was created with an index that is immediately written to cc->core_id, and spapr_core_plug() also relies on cc->core_id. Let's use it also in spapr_core_unplug(). Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Bharata B Rao <bharata@linux.vnet.ibm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Diffstat (limited to 'hw/misc/macio/mac_dbdma.c')
0 files changed, 0 insertions, 0 deletions