From 6577c3b509412ea596af57e67e3aaa55ed51a0bf Mon Sep 17 00:00:00 2001 From: David Gibson Date: Mon, 8 Aug 2016 10:06:25 +1000 Subject: [PATCH 20/21] spapr: Fix undefined behaviour in spapr_tce_reset() When a TCE table (sPAPR IOMMU context) is in disabled state (which is true by default for the 64-bit window), it has tcet->nb_table == 0 and tcet->table == NULL. However, on system reset, spapr_tce_reset() executes, which unconditionally calls memset(tcet->table, 0, table_size); We get away with this in practice, because it's a zero length memset(), but memset() on a NULL pointer is undefined behaviour, so we should not call it in this case. Reported-by: Peter Maydell Signed-off-by: David Gibson (cherry picked from commit 57c0eb1e0d6d8f01550d10cf08747f25cd537777) Signed-off-by: Michael Roth --- hw/ppc/spapr_iommu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c index d12c1cb..7be874d 100644 --- a/hw/ppc/spapr_iommu.c +++ b/hw/ppc/spapr_iommu.c @@ -384,7 +384,9 @@ static void spapr_tce_reset(DeviceState *dev) sPAPRTCETable *tcet = SPAPR_TCE_TABLE(dev); size_t table_size = tcet->nb_table * sizeof(uint64_t); - memset(tcet->table, 0, table_size); + if (tcet->nb_table) { + memset(tcet->table, 0, table_size); + } } static target_ulong put_tce_emu(sPAPRTCETable *tcet, target_ulong ioba, -- 1.9.1