On Mon, 17 Aug 2026 at 22:30, Doug Cook (WINDOWS) <[email protected]> wrote: > > TYPE_AX3000_SOC declares an Ax3000SoCClass via OBJECT_DECLARE_TYPE() and > ax3000_class_init() writes to it: > > Ax3000SoCClass *sc = AX3000_SOC_CLASS(oc); > sc->num_cpus = AX3000_NUM_CPUS; > > but its TypeInfo omits .class_size, so type_initialize() only allocates > class_size inherited from the parent, i.e. sizeof(SysBusDeviceClass). > The store to sc->num_cpus therefore writes 4 bytes of the value 4 just > past the end of the class allocation, corrupting whatever heap block > follows it. > > Fix by setting class_size. > > Fixes: 33a71a68c6e1 ("hw/arm: Add Axiado SoC AX3000") > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4197 > Signed-off-by: Doug Cook <[email protected]> > ---
Applied to target-arm.next, thanks. I took the liberty of fixing up the Author line to match your Signed-off-by: (i.e. removing the "(WINDOWS)" tag. Let me know if you'd prefer otherwise. -- PMM
