Re: [PATCH kvm-unit-tests] fw_cfg: avoid index out of bounds

[Paolo Bonzini <pbonzini@redhat.com>]

On 31/07/20 18:00, Nadav Amit wrote:
>>
>> On Jul 30, 2020, at 2:58 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>>
>> clang compilation fails with
>>
>> lib/x86/fwcfg.c:32:3: error: array index 17 is past the end of the array (which contains 16 elements) [-Werror,-Warray-bounds]
>>                fw_override[FW_CFG_MAX_RAM] = atol(str) * 1024 * 1024;
>>
>> The reason is that FW_CFG_MAX_RAM does not exist in the fw-cfg spec and was
>> added for bare metal support.  Fix the size of the array and rename FW_CFG_MAX_ENTRY
>> to FW_CFG_NUM_ENTRIES, so that it is clear that it must be one plus the
>> highest valid entry.
>>
>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>> ---
>> lib/x86/fwcfg.c | 6 +++---
>> lib/x86/fwcfg.h | 5 ++++-
>> 2 files changed, 7 insertions(+), 4 deletions(-)
>>
>> diff --git a/lib/x86/fwcfg.c b/lib/x86/fwcfg.c
>> index c2aaf5a..1734afb 100644
>> --- a/lib/x86/fwcfg.c
>> +++ b/lib/x86/fwcfg.c
>> @@ -4,7 +4,7 @@
>>
>> static struct spinlock lock;
>>
>> -static long fw_override[FW_CFG_MAX_ENTRY];
>> +static long fw_override[FW_CFG_NUM_ENTRIES];
>> static bool fw_override_done;
>>
>> bool no_test_device;
>> @@ -15,7 +15,7 @@ static void read_cfg_override(void)
>> 	int i;
>>
>> 	/* Initialize to negative value that would be considered as invalid */
>> -	for (i = 0; i < FW_CFG_MAX_ENTRY; i++)
>> +	for (i = 0; i < FW_CFG_NUM_ENTRIES; i++)
>> 		fw_override[i] = -1;
>>
>> 	if ((str = getenv("NR_CPUS")))
>> @@ -44,7 +44,7 @@ static uint64_t fwcfg_get_u(uint16_t index, int bytes)
>>     if (!fw_override_done)
>>         read_cfg_override();
>>
>> -    if (index < FW_CFG_MAX_ENTRY && fw_override[index] >= 0)
>> +    if (index < FW_CFG_NUM_ENTRIES && fw_override[index] >= 0)
>> 	    return fw_override[index];
>>
>>     spin_lock(&lock);
>> diff --git a/lib/x86/fwcfg.h b/lib/x86/fwcfg.h
>> index 64d4c6e..ac4257e 100644
>> --- a/lib/x86/fwcfg.h
>> +++ b/lib/x86/fwcfg.h
>> @@ -20,9 +20,12 @@
>> #define FW_CFG_NUMA             0x0d
>> #define FW_CFG_BOOT_MENU        0x0e
>> #define FW_CFG_MAX_CPUS         0x0f
>> -#define FW_CFG_MAX_ENTRY        0x10
>> +
>> +/* Dummy entries used when running on bare metal */
>> #define FW_CFG_MAX_RAM		0x11
>>
>> +#define FW_CFG_NUM_ENTRIES      (FW_CFG_MAX_RAM + 1)
>> +
>> #define FW_CFG_WRITE_CHANNEL    0x4000
>> #define FW_CFG_ARCH_LOCAL       0x8000
>> #define FW_CFG_ENTRY_MASK       ~(FW_CFG_WRITE_CHANNEL | FW_CFG_ARCH_LOCAL)
>> — 
>> 2.26.2
> 
> For the record: I did send a patch more than two weeks ago to fix this
> problem (that I created).

Oops, sorry.  I just saw it on the gitlab CI, I must have missed your patch.

Paolo