starred/qemu-qemu-1
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-07-08 17:56:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

accel/mshv: Fix pointer to proc feature bitfield

Browse Source 
Processor features are stored in a union containing two "banks":

union hv_partition_processor_features {
    uint64_t as_uint[2];
    struct {
        uint64_t sse3_support:1;
        ...
    }
}

get_proc_features() to retrieve the 2nd bank was passing a pointer that
steps over the whole union (+16B) instead of picking the 2nd bank _in_
the union. This manifests in mismatching feature bits for the 2nd bank
and possibly other side-effects caused by writing beyond the union.

We need to step over the first bank (+8B) by using as_uint64[0/1] to
correct this behaviour.

Resolves: Coverity CID 1660876
Fixes: 2f6da91e8a ("accel/mshv: store partition proc features")
Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Reviewed-by: Doru Blânzeanu <dblanzeanu@linux.microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20260701130335.418156-1-magnuskulke@linux.microsoft.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
This commit is contained in:
Magnus Kulke
2026-07-01 15:03:35 +02:00
committed by Philippe Mathieu-Daudé
parent abdd572a43
commit ce0b7a15bc
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
accel/mshv/mshv-all.c
View File

@@ -167,7 +167,7 @@ static int get_proc_features(int vm_fd,
ret = get_partition_property(vm_fd,
HV_PARTITION_PROPERTY_PROCESSOR_FEATURES0,
features[0].as_uint64);
&features->as_uint64[0]);
if (ret < 0) {
error_report("Failed to get processor features bank 0");
return -1;
@@ -175,7 +175,7 @@ static int get_proc_features(int vm_fd,
ret = get_partition_property(vm_fd,
HV_PARTITION_PROPERTY_PROCESSOR_FEATURES1,
features[1].as_uint64);
&features->as_uint64[1]);
if (ret < 0) {
error_report("Failed to get processor features bank 1");
return -1;