blob: ee87640a6ffbb530d8283fd123f1a7b372a152e5 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
id = 1571
title = "accel/hvf: Instance size not properly declared"
state = "opened"
created_at = "2023-04-02T19:27:47.892Z"
closed_at = "n/a"
labels = ["Bite Sized", "accel: HVF", "kind::Bug"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/1571"
host-os = "macOS"
host-arch = "x86_64/ARM"
qemu-version = "Almost HEAD"
guest-os = "Any supported by HVF"
guest-arch = "x86, AARCH64"
description = """In [`include/sysemu/hvf.h`](https://gitlab.com/qemu-project/qemu/-/blob/master/include/sysemu/hvf.h#L36), `HVFState` is declared to have the QOM type `TYPE_HVF_ACCEL`;
However, when the type is registered, proper `instance_size` for it was [not declared](https://gitlab.com/qemu-project/qemu/-/blob/master/accel/hvf/hvf-accel-ops.c#L351).
As a result, a bad workaround was introduced. That is, when [`hvf_accel_init`](https://gitlab.com/qemu-project/qemu/-/blob/master/accel/hvf/hvf-accel-ops.c#L329) is called from [`accel_init_machine`](https://gitlab.com/qemu-project/qemu/-/blob/master/accel/accel-softmmu.c#L33), an new instance of `HVFState` is allocated while we should have used the pre-allocated instance in `ms->accelerator` similar to [what KVM does](https://gitlab.com/qemu-project/qemu/-/blob/master/accel/kvm/kvm-all.c#L2381) (the code didn't do so since the allocated ([using `object_new_with_class`](https://gitlab.com/qemu-project/qemu/-/blob/master/softmmu/vl.c#L2218)) instance didn't allocate enough memory for `HVFState`).
Eventhough the code wouldn't crash nor have any serious implication, this would leak an `AccelState` and attempts to manually manage accelerators would cause a buffer-overflow."""
reproduce = """1. Run a HVF-accelerated VM"""
additional = """"""
|