From: Prasad J Pandit <p...@fedoraproject.org> When mapping physical memory into host's virtual address space, 'address_space_map' may return NULL if BounceBuffer is in_use. Set and return '*plen = 0' to avoid later NULL pointer dereference.
Reported-by: Alexander Bulekov <alx...@bu.edu> Fixes: https://bugs.launchpad.net/qemu/+bug/1878259 Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> --- exec.c | 1 + 1 file changed, 1 insertion(+) Update v3: set *plen = 0; -> https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06249.html diff --git a/exec.c b/exec.c index 5162f0d12f..4eea84bf66 100644 --- a/exec.c +++ b/exec.c @@ -3538,6 +3538,7 @@ void *address_space_map(AddressSpace *as, if (!memory_access_is_direct(mr, is_write)) { if (atomic_xchg(&bounce.in_use, true)) { + *plen = 0; return NULL; } /* Avoid unbounded allocations */ -- 2.26.2