)]}'
{
  "commit": "2e63eb2becc228232f12a1ea30a91b2aa8c5cecd",
  "tree": "f6b644baab5e92f9c33850a3b59898e52fc68dc4",
  "parents": [
    "d12c5b7ddf2cee57f3e72fe6f450203a9ab455ed"
  ],
  "author": {
    "name": "Simon Gaiser",
    "email": "hw42@ipsumj.de",
    "time": "Sat Oct 28 04:53:15 2017 +0200"
  },
  "committer": {
    "name": "Stefano Stabellini",
    "email": "sstabellini@kernel.org",
    "time": "Thu Dec 14 16:11:53 2017 -0800"
  },
  "message": "xen/pt: Set is_express to avoid out-of-bounds write\n\nThe passed-through device might be an express device. In this case the\nold code allocated a too small emulated config space in\npci_config_alloc() since pci_config_size() returned the size for a\nnon-express device. This leads to an out-of-bound write in\nxen_pt_config_reg_init(), which sometimes results in crashes. So set\nis_express as already done for KVM in vfio-pci.\n\nShortened ASan report:\n\n\u003d\u003d17512\u003d\u003dERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000041648 at pc 0x55e0fdac51ff bp 0x7ffe4af07410 sp 0x7ffe4af07408\nWRITE of size 2 at 0x611000041648 thread T0\n    #0 0x55e0fdac51fe in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53\n    #1 0x55e0fdac51fe in stw_he_p include/qemu/bswap.h:330\n    #2 0x55e0fdac51fe in stw_le_p include/qemu/bswap.h:379\n    #3 0x55e0fdac51fe in pci_set_word include/hw/pci/pci.h:490\n    #4 0x55e0fdac51fe in xen_pt_config_reg_init hw/xen/xen_pt_config_init.c:1991\n    #5 0x55e0fdac51fe in xen_pt_config_init hw/xen/xen_pt_config_init.c:2067\n    #6 0x55e0fdabcf4d in xen_pt_realize hw/xen/xen_pt.c:830\n    #7 0x55e0fdf59666 in pci_qdev_realize hw/pci/pci.c:2034\n    #8 0x55e0fdda7d3d in device_set_realized hw/core/qdev.c:914\n[...]\n\n0x611000041648 is located 8 bytes to the right of 256-byte region [0x611000041540,0x611000041640)\nallocated by thread T0 here:\n    #0 0x7ff596a94bb8 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd9bb8)\n    #1 0x7ff57da66580 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x50580)\n    #2 0x55e0fdda7d3d in device_set_realized hw/core/qdev.c:914\n[...]\n\nSigned-off-by: Simon Gaiser \u003chw42@ipsumj.de\u003e\nAcked-by: Stefano Stabellini \u003csstabellini@kernel.org\u003e\nSigned-off-by: Stefano Stabellini \u003csstabellini@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9bba717708bb2ac54df37d0f551517c4c4ef3fce",
      "old_mode": 33188,
      "old_path": "hw/xen/xen_pt.c",
      "new_id": "d57c6d348568a0639abd11c188b8779ca7924b86",
      "new_mode": 33188,
      "new_path": "hw/xen/xen_pt.c"
    }
  ]
}