kvm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Paolo Bonzini <pbonzini@redhat.com>
To: kvm@vger.kernel.org
Subject: [PATCH kvm-unit-tests] fw_cfg: avoid index out of bounds
Date: Thu, 30 Jul 2020 17:58:09 -0400	[thread overview]
Message-ID: <20200730215809.1970-1-pbonzini@redhat.com> (raw)

clang compilation fails with

lib/x86/fwcfg.c:32:3: error: array index 17 is past the end of the array (which contains 16 elements) [-Werror,-Warray-bounds]
                fw_override[FW_CFG_MAX_RAM] = atol(str) * 1024 * 1024;

The reason is that FW_CFG_MAX_RAM does not exist in the fw-cfg spec and was
added for bare metal support.  Fix the size of the array and rename FW_CFG_MAX_ENTRY
to FW_CFG_NUM_ENTRIES, so that it is clear that it must be one plus the
highest valid entry.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 lib/x86/fwcfg.c | 6 +++---
 lib/x86/fwcfg.h | 5 ++++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/lib/x86/fwcfg.c b/lib/x86/fwcfg.c
index c2aaf5a..1734afb 100644
--- a/lib/x86/fwcfg.c
+++ b/lib/x86/fwcfg.c
@@ -4,7 +4,7 @@
 
 static struct spinlock lock;
 
-static long fw_override[FW_CFG_MAX_ENTRY];
+static long fw_override[FW_CFG_NUM_ENTRIES];
 static bool fw_override_done;
 
 bool no_test_device;
@@ -15,7 +15,7 @@ static void read_cfg_override(void)
 	int i;
 
 	/* Initialize to negative value that would be considered as invalid */
-	for (i = 0; i < FW_CFG_MAX_ENTRY; i++)
+	for (i = 0; i < FW_CFG_NUM_ENTRIES; i++)
 		fw_override[i] = -1;
 
 	if ((str = getenv("NR_CPUS")))
@@ -44,7 +44,7 @@ static uint64_t fwcfg_get_u(uint16_t index, int bytes)
     if (!fw_override_done)
         read_cfg_override();
 
-    if (index < FW_CFG_MAX_ENTRY && fw_override[index] >= 0)
+    if (index < FW_CFG_NUM_ENTRIES && fw_override[index] >= 0)
 	    return fw_override[index];
 
     spin_lock(&lock);
diff --git a/lib/x86/fwcfg.h b/lib/x86/fwcfg.h
index 64d4c6e..ac4257e 100644
--- a/lib/x86/fwcfg.h
+++ b/lib/x86/fwcfg.h
@@ -20,9 +20,12 @@
 #define FW_CFG_NUMA             0x0d
 #define FW_CFG_BOOT_MENU        0x0e
 #define FW_CFG_MAX_CPUS         0x0f
-#define FW_CFG_MAX_ENTRY        0x10
+
+/* Dummy entries used when running on bare metal */
 #define FW_CFG_MAX_RAM		0x11
 
+#define FW_CFG_NUM_ENTRIES      (FW_CFG_MAX_RAM + 1)
+
 #define FW_CFG_WRITE_CHANNEL    0x4000
 #define FW_CFG_ARCH_LOCAL       0x8000
 #define FW_CFG_ENTRY_MASK       ~(FW_CFG_WRITE_CHANNEL | FW_CFG_ARCH_LOCAL)
-- 
2.26.2


             reply	other threads:[~2020-07-30 21:58 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-30 21:58 Paolo Bonzini [this message]
2020-07-31 16:00 ` [PATCH kvm-unit-tests] fw_cfg: avoid index out of bounds Nadav Amit
2020-07-31 16:05   ` Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200730215809.1970-1-pbonzini@redhat.com \
    --to=pbonzini@redhat.com \
    --cc=kvm@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).