Commit 214191f6b574 ("x86/loader: read complete kernel") changed the
semantics of kernel_size from the piggyback kernel to the whole kernel
file, which leads to the setup_data_offset contains setup_size and leads
to wrong address of setup_data being written in header[0x250].

Fix it by minusing setup_size.

Fixes: 214191f6b574 ("x86/loader: read complete kernel")
Signed-off-by: Xiaoyao Li <xiaoyao...@intel.com>
---
 hw/i386/x86-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
index 7512be64d67b..127b85eb02cc 100644
--- a/hw/i386/x86-common.c
+++ b/hw/i386/x86-common.c
@@ -935,7 +935,7 @@ void x86_load_linux(X86MachineState *x86ms,
         kernel_size = setup_data_offset + sizeof(struct setup_data) + dtb_size;
         kernel = g_realloc(kernel, kernel_size);
 
-        stq_le_p(header + 0x250, prot_addr + setup_data_offset);
+        stq_le_p(header + 0x250, prot_addr + setup_data_offset - setup_size);
 
         setup_data = (struct setup_data *)(kernel + setup_data_offset);
         setup_data->next = 0;
-- 
2.43.0


Reply via email to