From: Daniel P. Berrange <berrange@redhat.com>
Date: Wed, 4 Sep 2013 16:41:55 +0000 (+0100)
Subject: Ensure 'arch' is always set in cpuArchNodeData
X-Git-Tag: CVE-2013-4311~109
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=66ec11ade4664c85a158a2c309517baa8b5b048f;p=thirdparty%2Flibvirt.git

Ensure 'arch' is always set in cpuArchNodeData

The s390, ppc and arm CPU drivers never set the 'arch' field
in their impl of cpuArchNodeData. This leads to error messages
being reported from cpuDataFree later, due to trying to use
VIR_ARCH_NONE.

 #0  virRaiseErrorFull (filename=filename@entry=0x76f94434 "cpu/cpu.c", funcname=funcname@entry=0x76f942dc <__FUNCTION__.18096> "cpuGetSubDriver", linenr=linenr@entry=58,
     domain=domain@entry=31, code=code@entry=1, level=level@entry=VIR_ERR_ERROR, str1=0x76f70e18 "internal error: %s",
     str2=str2@entry=0x7155f2ec "undefined hardware architecture", str3=str3@entry=0x0, int1=int1@entry=-1, int2=int2@entry=-1, fmt=0x76f70e18 "internal error: %s")
     at util/virerror.c:646
 #1  0x76e682ea in virReportErrorHelper (domcode=domcode@entry=31, errorcode=errorcode@entry=1, filename=0x76f94434 "cpu/cpu.c",
     funcname=0x76f942dc <__FUNCTION__.18096> "cpuGetSubDriver", linenr=linenr@entry=58, fmt=0x76f7e7e4 "%s") at util/virerror.c:1292
 #2  0x76ed82d4 in cpuGetSubDriver (arch=<optimized out>) at cpu/cpu.c:57
 #3  cpuGetSubDriver (arch=VIR_ARCH_NONE) at cpu/cpu.c:51
 #4  0x76ed8818 in cpuDataFree (data=data@entry=0x70c22d78) at cpu/cpu.c:216
 #5  0x716aaec0 in virQEMUCapsInitCPU (arch=VIR_ARCH_ARMV7L, caps=0x70c29a08) at qemu/qemu_capabilities.c:867

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---

diff --git a/src/cpu/cpu.c b/src/cpu/cpu.c
index 023ce2652a..50c2de3183 100644
--- a/src/cpu/cpu.c
+++ b/src/cpu/cpu.c
@@ -244,7 +244,7 @@ cpuNodeData(virArch arch)
         return NULL;
     }
 
-    return driver->nodeData();
+    return driver->nodeData(arch);
 }
 
 
diff --git a/src/cpu/cpu.h b/src/cpu/cpu.h
index 7f1d4bd027..69f6fae000 100644
--- a/src/cpu/cpu.h
+++ b/src/cpu/cpu.h
@@ -70,7 +70,7 @@ typedef void
 (*cpuArchDataFree)  (virCPUDataPtr data);
 
 typedef virCPUDataPtr
-(*cpuArchNodeData)  (void);
+(*cpuArchNodeData)  (virArch arch);
 
 typedef virCPUCompareResult
 (*cpuArchGuestData) (virCPUDefPtr host,
diff --git a/src/cpu/cpu_arm.c b/src/cpu/cpu_arm.c
index d1b2a99b17..06c5dc0897 100644
--- a/src/cpu/cpu_arm.c
+++ b/src/cpu/cpu_arm.c
@@ -31,11 +31,15 @@
 static const virArch archs[] = { VIR_ARCH_ARMV7L };
 
 static virCPUDataPtr
-ArmNodeData(void)
+ArmNodeData(virArch arch)
 {
     virCPUDataPtr data;
 
-    ignore_value(VIR_ALLOC(data));
+    if (VIR_ALLOC(data) < 0)
+        return NULL;
+
+    data->arch = arch;
+
     return data;
 }
 
diff --git a/src/cpu/cpu_powerpc.c b/src/cpu/cpu_powerpc.c
index 647a8a11e2..35cb9490cb 100644
--- a/src/cpu/cpu_powerpc.c
+++ b/src/cpu/cpu_powerpc.c
@@ -353,21 +353,23 @@ ppcDataFree(virCPUDataPtr data)
     VIR_FREE(data);
 }
 
-#if defined(__powerpc__) || defined(__powerpc64__)
 static virCPUDataPtr
-ppcNodeData(void)
+ppcNodeData(virArch arch)
 {
     virCPUDataPtr cpuData;
 
     if (VIR_ALLOC(cpuData) < 0)
         return NULL;
 
+    cpuData->arch = arch;
+
+#if defined(__powerpc__) || defined(__powerpc64__)
     asm("mfpvr %0"
         : "=r" (cpuData->data.ppc.pvr));
+#endif
 
     return cpuData;
 }
-#endif
 
 static int
 ppcUpdate(virCPUDefPtr guest ATTRIBUTE_UNUSED,
@@ -474,11 +476,7 @@ struct cpuArchDriver cpuDriverPowerPC = {
     .decode     = ppcDecode,
     .encode     = NULL,
     .free       = ppcDataFree,
-#if defined(__powerpc__) || defined(__powerpc64__)
     .nodeData   = ppcNodeData,
-#else
-    .nodeData   = NULL,
-#endif
     .guestData  = NULL,
     .baseline   = ppcBaseline,
     .update     = ppcUpdate,
diff --git a/src/cpu/cpu_s390.c b/src/cpu/cpu_s390.c
index d997e06d9a..de33e4a9e3 100644
--- a/src/cpu/cpu_s390.c
+++ b/src/cpu/cpu_s390.c
@@ -32,13 +32,15 @@
 static const virArch archs[] = { VIR_ARCH_S390, VIR_ARCH_S390X };
 
 static virCPUDataPtr
-s390NodeData(void)
+s390NodeData(virArch arch)
 {
     virCPUDataPtr data;
 
     if (VIR_ALLOC(data) < 0)
         return NULL;
 
+    data->arch = arch;
+
     return data;
 }
 
diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c
index 41ce21fa76..3d5e16f661 100644
--- a/src/cpu/cpu_x86.c
+++ b/src/cpu/cpu_x86.c
@@ -1675,7 +1675,7 @@ cpuidSet(uint32_t base, struct cpuX86cpuid **set)
 
 
 static virCPUDataPtr
-x86NodeData(void)
+x86NodeData(virArch arch)
 {
     virCPUDataPtr cpuData = NULL;
     struct cpuX86Data *data;
@@ -1692,7 +1692,7 @@ x86NodeData(void)
         goto error;
     data->extended_len = ret;
 
-    if (!(cpuData = x86MakeCPUData(virArchFromHost(), &data)))
+    if (!(cpuData = x86MakeCPUData(arch, &data)))
         goto error;
 
     return cpuData;