diff mbox series

[65/78] dump: Fix writing of ELF section

Message ID	20200616141547.24664-66-mdroth@linux.vnet.ibm.com
State	New
Headers	show Delivered-To: patch@linaro.org Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; From: Michael Roth <mdroth@linux.vnet.ibm.com> To: qemu-devel@nongnu.org Subject: [PATCH 65/78] dump: Fix writing of ELF section Date: Tue, 16 Jun 2020 09:15:34 -0500 Message-Id: <20200616141547.24664-66-mdroth@linux.vnet.ibm.com> In-Reply-To: <20200616141547.24664-1-mdroth@linux.vnet.ibm.com> References: <20200616141547.24664-1-mdroth@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2607:f8b0:4864:20::241; envelope-from=flukshun@gmail.com; helo=mail-oi1-x241.google.com Precedence: list Cc: Peter Maydell <peter.maydell@linaro.org>, qemu-stable@nongnu.org Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" <qemu-devel-bounces+patch=linaro.org@nongnu.org>
Series	Patch Round-up for stable 4.2.1, freeze on 2020-06-22 \| expand [00/78] Patch Round-up for stable 4.2.1, freeze on 2020-06-22 [02/78] block/nbd: fix memory leak in nbd_open() [05/78] target/arm: ensure we use current exception state after SCR update [09/78] numa: properly check if numa is supported [11/78] arm/arm-powerctl: set NSACR.{CP11, CP10} bits in arm_set_cpu_on() [13/78] hw/i386/pc: fix regression in parsing vga cmdline parameter [15/78] ide: Fix incorrect handling of some PRDTs in ide_dma_cb() [16/78] target/arm: Set ISSIs16Bit in make_issinfo [17/78] virtio: update queue size on guest write [19/78] virtio: add ability to delete vq through a pointer [21/78] virtio: reset region cache when on queue deletion [22/78] virtio-net: delete also control queue when TX/RX deleted [23/78] intel_iommu: a fix to vtd_find_as_from_bus_num() [24/78] intel_iommu: add present bit check for pasid table entries [27/78] dp8393x: Mask EOL bit from descriptor addresses [29/78] dp8393x: Clean up endianness hacks [31/78] dp8393x: Update LLFA and CRDA registers from rx descriptor [32/78] dp8393x: Clear RRRA command register bit only when appropriate [35/78] dp8393x: Use long-word-aligned RRA pointers in 32-bit mode [36/78] dp8393x: Pad frames to word or long word boundary [39/78] dp8393x: Don't reset Silicon Revision register [42/78] plugins/core: add missing break in cb_to_tcg_flags [43/78] tcg: save vaddr temp for plugin usage [48/78] iotests/026: Test EIO on preallocated zero cluster [49/78] iotests/026: Test EIO on allocation in a data-file [50/78] virtio: gracefully handle invalid region caches [51/78] scsi/qemu-pr-helper: Fix out-of-bounds access to trnptid_list[] [52/78] block/qcow2-threads: fix qcow2_decompress [53/78] job: refactor progress to separate object [57/78] compat: disable edid on correct virtio-gpu device [58/78] qga: Installer: Wait for installation to finish [59/78] qga-win: Handle VSS_E_PROVIDER_ALREADY_REGISTERED error [60/78] qga-win: prevent crash when executing guest-file-read with large count [61/78] qga: Fix undefined C behavior [63/78] hw/i386/amd_iommu.c: Fix corruption of log events passed to guest [64/78] tcg/i386: Fix INDEX_op_dup2_vec [65/78] dump: Fix writing of ELF section [67/78] vhost-user-gpu: Release memory returned by vu_queue_pop() with free() [69/78] hostmem: don't use mbind() if host-nodes is empty [70/78] target/arm: Clear tail in gvec_fmul_idx_, gvec_fmla_idx_ [72/78] 9p: Lock directory streams with a CoMutex [73/78] net: Do not include a newline in the id of -nic devices [74/78] nbd/server: Avoid long error message assertions CVE-2020-10761 [77/78] virtio-balloon: unref the iothread when unrealizing

Commit Message

Michael Roth June 16, 2020, 2:15 p.m. UTC

From: Peter Maydell <peter.maydell@linaro.org>


In write_elf_section() we set the 'shdr' pointer to point to local
structures shdr32 or shdr64, which we fill in to be written out to
the ELF dump.  Unfortunately the address we pass to fd_write_vmcore()
has a spurious '&' operator, so instead of writing out the section
header we write out the literal pointer value followed by whatever is
on the stack after the 'shdr' local variable.

Pass the correct address into fd_write_vmcore().

Spotted by Coverity: CID 1421970.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Message-id: 20200324173630.12221-1-peter.maydell@linaro.org
(cherry picked from commit 174d2d6856bf435f4f58e9303ba30dd0e1279d3f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

---
 dump/dump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.17.1

diff mbox series

Patch

diff --git a/dump/dump.c b/dump/dump.c
index 6fb6e1245a..22ed1d3b0d 100644
--- a/dump/dump.c
+++ b/dump/dump.c
@@ -364,7 +364,7 @@  static void write_elf_section(DumpState *s, int type, Error **errp)
         shdr = &shdr64;
     }
 
-    ret = fd_write_vmcore(&shdr, shdr_size, s);
+    ret = fd_write_vmcore(shdr, shdr_size, s);
     if (ret < 0) {
         error_setg_errno(errp, -ret,
                          "dump: failed to write section header table");