[PATCH v2 00/30] glib: Replace g_memdup() by g_memdup2()

[PATCH v2 00/30] glib: Replace g_memdup() by g_memdup2()

[Philippe Mathieu-Daudé]

Per https://discourse.gnome.org/t/port-your-module-from-g-memdup-to-g-memdup2-now/5538

  The old API took the size of the memory to duplicate as a guint,
  whereas most memory functions take memory sizes as a gsize. This
  made it easy to accidentally pass a gsize to g_memdup(). For large
  values, that would lead to a silent truncation of the size from 64
  to 32 bits, and result in a heap area being returned which is
  significantly smaller than what the caller expects. This can likely
  be exploited in various modules to cause a heap buffer overflow.

g_memdup() as been deprecated in GLib 2.68. Since QEMU defines
GLIB_VERSION_MAX_ALLOWED to GLIB_VERSION_2_56, the deprecation
is not displayed (on GLib >= 2.68 such available on Fedora 34).
However the function is still unsafe, so it is better to avoid
its use.

This series provides the safely equivalent g_memdup2() wrapper,
and replace all g_memdup() calls by it.

The previous link recommend to audit the call sites. Most of the
calls use byte_size=sizeof(STRUCT), and no STRUCT appears to be
> 4GiB.  Few calls use unsigned/size_t/uint16_t. Where code is
doing multiplication, patches are sent as RFC. In particular:
    hw/net/virtio-net.c
    hw/virtio/virtio-crypto.c

Since v1:
- Added missing g_memdup2 -> g_memdup2_qemu compat definition (danpb)
- Do not call g_memdup2_qemu() but directly g_memdup2() (danpb)

Philippe Mathieu-Daudé (30):
  hw/hyperv/vmbus: Remove unused vmbus_load/save_req()
  glib-compat: Introduce g_memdup2() wrapper
  qapi: Replace g_memdup() by g_memdup2()
  accel/tcg: Replace g_memdup() by g_memdup2()
  block/qcow2-bitmap: Replace g_memdup() by g_memdup2()
  softmmu: Replace g_memdup() by g_memdup2()
  hw/9pfs: Replace g_memdup() by g_memdup2()
  hw/acpi: Avoid truncating acpi_data_len() to 32-bit
  hw/acpi: Replace g_memdup() by g_memdup2()
  hw/core/machine: Replace g_memdup() by g_memdup2()
  hw/hppa/machine: Replace g_memdup() by g_memdup2()
  hw/i386/multiboot: Replace g_memdup() by g_memdup2()
  hw/net/eepro100: Replace g_memdup() by g_memdup2()
  hw/nvram/fw_cfg: Replace g_memdup() by g_memdup2()
  hw/scsi/mptsas: Replace g_memdup() by g_memdup2()
  hw/ppc/spapr_pci: Replace g_memdup() by g_memdup2()
  hw/rdma: Replace g_memdup() by g_memdup2()
  hw/vfio/pci: Replace g_memdup() by g_memdup2()
  RFC hw/virtio: Replace g_memdup() by g_memdup2()
  net/colo: Replace g_memdup() by g_memdup2()
  RFC ui/clipboard: Replace g_memdup() by g_memdup2()
  RFC linux-user: Replace g_memdup() by g_memdup2()
  tests/unit: Replace g_memdup() by g_memdup2()
  tests/qtest: Replace g_memdup() by g_memdup2()
  target/arm: Replace g_memdup() by g_memdup2()
  target/ppc: Replace g_memdup() by g_memdup2()
  contrib: Replace g_memdup() by g_memdup2()
  checkpatch: Do not allow deprecated g_memdup()
  f
  test

 include/glib-compat.h       | 41 ++++++++++++++++++++++++--
 include/hw/hyperv/vmbus.h   |  3 --
 accel/tcg/cputlb.c          |  8 ++---
 block/qcow2-bitmap.c        |  2 +-
 contrib/plugins/lockstep.c  |  2 +-
 contrib/rdmacm-mux/main.c   | 10 +++----
 hw/9pfs/9p-synth.c          |  2 +-
 hw/9pfs/9p.c                |  2 +-
 hw/acpi/core.c              |  3 +-
 hw/arm/virt-acpi-build.c    |  2 +-
 hw/core/machine.c           |  4 +--
 hw/hppa/machine.c           |  8 ++---
 hw/hyperv/vmbus.c           | 59 -------------------------------------
 hw/i386/acpi-build.c        |  6 ++--
 hw/i386/multiboot.c         |  2 +-
 hw/net/eepro100.c           |  2 +-
 hw/net/virtio-net.c         |  3 +-
 hw/nvram/fw_cfg.c           |  9 +++---
 hw/ppc/spapr_pci.c          |  7 ++---
 hw/rdma/rdma_utils.c        |  2 +-
 hw/scsi/mptsas.c            |  5 ++--
 hw/vfio/pci.c               |  2 +-
 hw/virtio/virtio-crypto.c   |  6 ++--
 linux-user/syscall.c        |  2 +-
 linux-user/uaccess.c        |  2 +-
 net/colo.c                  |  4 +--
 qapi/qapi-clone-visitor.c   | 16 +++++-----
 qapi/qapi-visit-core.c      |  6 ++--
 softmmu/memory.c            |  2 +-
 softmmu/vl.c                |  2 +-
 target/arm/helper.c         |  6 ++--
 target/ppc/mmu-hash64.c     |  2 +-
 tests/qtest/libqos/ahci.c   |  6 ++--
 tests/qtest/libqos/qgraph.c |  2 +-
 tests/unit/ptimer-test.c    | 22 +++++++-------
 tests/unit/test-iov.c       | 26 ++++++++--------
 ui/clipboard.c              |  2 +-
 scripts/checkpatch.pl       |  5 ++++
 38 files changed, 140 insertions(+), 155 deletions(-)

-- 
2.31.1

[PATCH v2 01/30] hw/hyperv/vmbus: Remove unused vmbus_load/save_req()

[Philippe Mathieu-Daudé]

vmbus_save_req() and vmbus_load_req() are not used.
Remove them to avoid maintaining dead code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
 include/hw/hyperv/vmbus.h |  3 --
 hw/hyperv/vmbus.c         | 59 ---------------------------------------
 2 files changed, 62 deletions(-)

diff --git a/include/hw/hyperv/vmbus.h b/include/hw/hyperv/vmbus.h
index f98bea3888d..8ea660dd8e6 100644
--- a/include/hw/hyperv/vmbus.h
+++ b/include/hw/hyperv/vmbus.h
@@ -223,7 +223,4 @@ int vmbus_map_sgl(VMBusChanReq *req, DMADirection dir, struct iovec *iov,
 void vmbus_unmap_sgl(VMBusChanReq *req, DMADirection dir, struct iovec *iov,
                      unsigned iov_cnt, size_t accessed);
 
-void vmbus_save_req(QEMUFile *f, VMBusChanReq *req);
-void *vmbus_load_req(QEMUFile *f, VMBusDevice *dev, uint32_t size);
-
 #endif
diff --git a/hw/hyperv/vmbus.c b/hw/hyperv/vmbus.c
index c9887d5a7bc..18d3c3b9240 100644
--- a/hw/hyperv/vmbus.c
+++ b/hw/hyperv/vmbus.c
@@ -1311,65 +1311,6 @@ static const VMStateDescription vmstate_vmbus_chan_req = {
     }
 };
 
-void vmbus_save_req(QEMUFile *f, VMBusChanReq *req)
-{
-    VMBusChanReqSave req_save;
-
-    req_save.chan_idx = req->chan->subchan_idx;
-    req_save.pkt_type = req->pkt_type;
-    req_save.msglen = req->msglen;
-    req_save.msg = req->msg;
-    req_save.transaction_id = req->transaction_id;
-    req_save.need_comp = req->need_comp;
-    req_save.num = req->sgl.nsg;
-    req_save.sgl = g_memdup(req->sgl.sg,
-                            req_save.num * sizeof(ScatterGatherEntry));
-
-    vmstate_save_state(f, &vmstate_vmbus_chan_req, &req_save, NULL);
-
-    g_free(req_save.sgl);
-}
-
-void *vmbus_load_req(QEMUFile *f, VMBusDevice *dev, uint32_t size)
-{
-    VMBusChanReqSave req_save;
-    VMBusChanReq *req = NULL;
-    VMBusChannel *chan = NULL;
-    uint32_t i;
-
-    vmstate_load_state(f, &vmstate_vmbus_chan_req, &req_save, 0);
-
-    if (req_save.chan_idx >= dev->num_channels) {
-        error_report("%s: %u(chan_idx) > %u(num_channels)", __func__,
-                     req_save.chan_idx, dev->num_channels);
-        goto out;
-    }
-    chan = &dev->channels[req_save.chan_idx];
-
-    if (vmbus_channel_reserve(chan, 0, req_save.msglen)) {
-        goto out;
-    }
-
-    req = vmbus_alloc_req(chan, size, req_save.pkt_type, req_save.msglen,
-                          req_save.transaction_id, req_save.need_comp);
-    if (req_save.msglen) {
-        memcpy(req->msg, req_save.msg, req_save.msglen);
-    }
-
-    for (i = 0; i < req_save.num; i++) {
-        qemu_sglist_add(&req->sgl, req_save.sgl[i].base, req_save.sgl[i].len);
-    }
-
-out:
-    if (req_save.msglen) {
-        g_free(req_save.msg);
-    }
-    if (req_save.num) {
-        g_free(req_save.sgl);
-    }
-    return req;
-}
-
 static void channel_event_cb(EventNotifier *e)
 {
     VMBusChannel *chan = container_of(e, VMBusChannel, notifier);
-- 
2.31.1

[PATCH v2 02/30] glib-compat: Introduce g_memdup2() wrapper

[Philippe Mathieu-Daudé]

When experimenting raising GLIB_VERSION_MIN_REQUIRED to 2.68
(Fedora 34 provides GLib 2.68.1) we get:

  hw/virtio/virtio-crypto.c:245:24: error: 'g_memdup' is deprecated: Use 'g_memdup2' instead [-Werror,-Wdeprecated-declarations]
  ...

g_memdup() has been updated by g_memdup2() to fix eventual security
issues (size argument is 32-bit and could be truncated / wrapping).
GLib recommends to copy their static inline version of g_memdup2():
https://discourse.gnome.org/t/port-your-module-from-g-memdup-to-g-memdup2-now/5538

Our glib-compat.h provides a comment explaining how to deal with
these deprecated declarations (see commit e71e8cc0355
"glib: enforce the minimum required version and warn about old APIs").

Following this comment suggestion, implement the g_memdup2_qemu()
wrapper to g_memdup2(), and use the safer equivalent inlined when
we are using pre-2.68 GLib.

Reported-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
 include/glib-compat.h | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/include/glib-compat.h b/include/glib-compat.h
index 9e95c888f54..915d0156da0 100644
--- a/include/glib-compat.h
+++ b/include/glib-compat.h
@@ -68,6 +68,43 @@
  * without generating warnings.
  */
 
+/*
+ * g_memdup2_qemu:
+ * @mem: (nullable): the memory to copy.
+ * @byte_size: the number of bytes to copy.
+ *
+ * Allocates @byte_size bytes of memory, and copies @byte_size bytes into it
+ * from @mem. If @mem is %NULL it returns %NULL.
+ *
+ * This replaces g_memdup(), which was prone to integer overflows when
+ * converting the argument from a #gsize to a #guint.
+ *
+ * This static inline version is a backport of the new public API from
+ * GLib 2.68, kept internal to GLib for backport to older stable releases.
+ * See https://gitlab.gnome.org/GNOME/glib/-/issues/2319.
+ *
+ * Returns: (nullable): a pointer to the newly-allocated copy of the memory,
+ *          or %NULL if @mem is %NULL.
+ */
+static inline gpointer g_memdup2_qemu(gconstpointer mem, gsize byte_size)
+{
+#if GLIB_CHECK_VERSION(2, 68, 0)
+    return g_memdup2(mem, byte_size);
+#else
+    gpointer new_mem;
+
+    if (mem && byte_size != 0) {
+        new_mem = g_malloc(byte_size);
+        memcpy(new_mem, mem, byte_size);
+    } else {
+        new_mem = NULL;
+    }
+
+    return new_mem;
+#endif
+}
+#define g_memdup2(a) g_memdup2_qemu(a)
+
 #if defined(G_OS_UNIX)
 /*
  * Note: The fallback implementation is not MT-safe, and it returns a copy of
-- 
2.31.1

Re: [PATCH v2 00/30] glib: Replace g_memdup() by g_memdup2()

[Philippe Mathieu-Daudé]

On 9/3/21 7:39 PM, Philippe Mathieu-Daudé wrote:
> Per https://discourse.gnome.org/t/port-your-module-from-g-memdup-to-g-memdup2-now/5538
> 
>   The old API took the size of the memory to duplicate as a guint,
>   whereas most memory functions take memory sizes as a gsize. This
>   made it easy to accidentally pass a gsize to g_memdup(). For large
>   values, that would lead to a silent truncation of the size from 64
>   to 32 bits, and result in a heap area being returned which is
>   significantly smaller than what the caller expects. This can likely
>   be exploited in various modules to cause a heap buffer overflow.
> 
> g_memdup() as been deprecated in GLib 2.68. Since QEMU defines
> GLIB_VERSION_MAX_ALLOWED to GLIB_VERSION_2_56, the deprecation
> is not displayed (on GLib >= 2.68 such available on Fedora 34).
> However the function is still unsafe, so it is better to avoid
> its use.
> 
> This series provides the safely equivalent g_memdup2() wrapper,
> and replace all g_memdup() calls by it.
> 
> The previous link recommend to audit the call sites. Most of the
> calls use byte_size=sizeof(STRUCT), and no STRUCT appears to be
>> 4GiB.  Few calls use unsigned/size_t/uint16_t. Where code is
> doing multiplication, patches are sent as RFC. In particular:
>     hw/net/virtio-net.c
>     hw/virtio/virtio-crypto.c
> 
> Since v1:
> - Added missing g_memdup2 -> g_memdup2_qemu compat definition (danpb)
> - Do not call g_memdup2_qemu() but directly g_memdup2() (danpb)
> 
> Philippe Mathieu-Daudé (30):
>   hw/hyperv/vmbus: Remove unused vmbus_load/save_req()
>   glib-compat: Introduce g_memdup2() wrapper
>   qapi: Replace g_memdup() by g_memdup2()
>   accel/tcg: Replace g_memdup() by g_memdup2()
>   block/qcow2-bitmap: Replace g_memdup() by g_memdup2()
>   softmmu: Replace g_memdup() by g_memdup2()
>   hw/9pfs: Replace g_memdup() by g_memdup2()
>   hw/acpi: Avoid truncating acpi_data_len() to 32-bit
>   hw/acpi: Replace g_memdup() by g_memdup2()
>   hw/core/machine: Replace g_memdup() by g_memdup2()
>   hw/hppa/machine: Replace g_memdup() by g_memdup2()
>   hw/i386/multiboot: Replace g_memdup() by g_memdup2()
>   hw/net/eepro100: Replace g_memdup() by g_memdup2()
>   hw/nvram/fw_cfg: Replace g_memdup() by g_memdup2()
>   hw/scsi/mptsas: Replace g_memdup() by g_memdup2()
>   hw/ppc/spapr_pci: Replace g_memdup() by g_memdup2()
>   hw/rdma: Replace g_memdup() by g_memdup2()
>   hw/vfio/pci: Replace g_memdup() by g_memdup2()
>   RFC hw/virtio: Replace g_memdup() by g_memdup2()
>   net/colo: Replace g_memdup() by g_memdup2()
>   RFC ui/clipboard: Replace g_memdup() by g_memdup2()
>   RFC linux-user: Replace g_memdup() by g_memdup2()
>   tests/unit: Replace g_memdup() by g_memdup2()
>   tests/qtest: Replace g_memdup() by g_memdup2()
>   target/arm: Replace g_memdup() by g_memdup2()
>   target/ppc: Replace g_memdup() by g_memdup2()
>   contrib: Replace g_memdup() by g_memdup2()
>   checkpatch: Do not allow deprecated g_memdup()
>   f
>   test

I figured too late I was not placed in the correct commit,
please disregard this incomplete series...