This series adds checks for APIC ID limits on initialization and CPU hotplug
code.
This fixes multiple issues:
1) Assertion failure when -smp parameter results in a too large APIC ID. e.g.:
$ ./install/bin/qemu-system-x86_64 -S -smp
254,cores=17,threads=17,sockets=17,maxcpus=254 -nographic
**
ERROR:hw/acpi/cpu_hotplug.c:58:AcpiCpuHotplug_init: assertion failed: ((id
/ 8) < ACPI_GPE_PROC_LEN)
Aborted (core dumped)
2) Memory corruption on AcpiCpuHotplug_add() when APIC ID is too large (similar
to the case above, but on CPU hotplug).
3) Out of bounds access on node_cpumask on pc_guest_info_init(), if APIC IDs
are too large.
Eduardo Habkost (4):
acpi: Add ACPI_CPU_HOTPLUG_ID_LIMIT macro
pc: Refuse CPU hotplug if the resulting APIC ID is too large
acpi: Assert sts array limit on AcpiCpuHotplug_add()
pc: Refuse max_cpus if it results in too large APIC ID
hw/acpi/cpu_hotplug.c | 1 +
hw/i386/pc.c | 17 +++++++++++++++++
include/hw/acpi/cpu_hotplug_defs.h | 8 ++++++++
3 files changed, 26 insertions(+)
--
1.8.5.3
