From 43d70ddf9f96b3ad037abe4d5f9f2768196b8c92 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Sun, 29 Jan 2017 12:00:59 +0100 Subject: cpu-exec: fix icount out-of-bounds access When icount is active, tb_add_jump is surprisingly called with an out of bounds basic block index. I have no idea how that can work, but it does not seem like a good idea. Clear *last_tb for all TB_EXIT_ICOUNT_EXPIRED cases, even when all you have to do is refill icount_extra. Signed-off-by: Paolo Bonzini --- include/exec/exec-all.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include/exec/exec-all.h') diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h index bbc9478a50..21ab7bf3fd 100644 --- a/include/exec/exec-all.h +++ b/include/exec/exec-all.h @@ -318,6 +318,7 @@ static inline void tb_set_jmp_target(TranslationBlock *tb, static inline void tb_add_jump(TranslationBlock *tb, int n, TranslationBlock *tb_next) { + assert(n < ARRAY_SIZE(tb->jmp_list_next)); if (tb->jmp_list_next[n]) { /* Another thread has already done this while we were * outside of the lock; nothing to do in this case */ -- cgit 1.4.1