From: "Philippe Mathieu-Daudé" <f4bug@amsat.org>
To: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>,
qemu-devel@nongnu.org, alxndr@bu.edu, laurent@vivier.eu,
pbonzini@redhat.com
Subject: Re: [PATCH v4 for-6.0 05/12] esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf()
Date: Mon, 12 Apr 2021 12:47:51 +0200 [thread overview]
Message-ID: <06ed2995-d11d-6c85-49dc-aaf1ad7f552f@amsat.org> (raw)
In-Reply-To: <20210407195801.685-6-mark.cave-ayland@ilande.co.uk>
On 4/7/21 9:57 PM, Mark Cave-Ayland wrote:
> The const pointer returned by fifo8_pop_buf() lies directly within the array used
> to model the FIFO. Building with address sanitizers enabled shows that if the
> caller expects a minimum number of bytes present then if the FIFO is nearly full,
> the caller may unexpectedly access past the end of the array.
>
> Introduce esp_fifo_pop_buf() which takes a destination buffer and performs a
> memcpy() in it to guarantee that the caller cannot overwrite the FIFO array and
> update all callers to use it. Similarly add underflow protection similar to
> esp_fifo_push() and esp_fifo_pop() so that instead of triggering an assert()
> the operation becomes a no-op.
>
> Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
> Tested-by: Alexander Bulekov <alxndr@bu.edu>
> ---
> hw/scsi/esp.c | 40 ++++++++++++++++++++++++++++------------
> 1 file changed, 28 insertions(+), 12 deletions(-)
Way cleaner/safer.
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
next prev parent reply other threads:[~2021-04-12 10:49 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-07 19:57 [PATCH v4 for-6.0 00/12] esp: fix asserts/segfaults discovered by fuzzer Mark Cave-Ayland
2021-04-07 19:57 ` [PATCH v4 for-6.0 01/12] esp: always check current_req is not NULL before use in DMA callbacks Mark Cave-Ayland
2021-04-07 19:57 ` [PATCH v4 for-6.0 02/12] esp: rework write_response() to avoid using the FIFO for DMA transactions Mark Cave-Ayland
2021-04-07 21:27 ` Philippe Mathieu-Daudé
2021-04-07 19:57 ` [PATCH v4 for-6.0 03/12] esp: consolidate esp_cmdfifo_push() into esp_fifo_push() Mark Cave-Ayland
2021-04-07 19:57 ` [PATCH v4 for-6.0 04/12] esp: consolidate esp_cmdfifo_pop() into esp_fifo_pop() Mark Cave-Ayland
2021-04-07 19:57 ` [PATCH v4 for-6.0 05/12] esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf() Mark Cave-Ayland
2021-04-12 10:47 ` Philippe Mathieu-Daudé [this message]
2021-04-12 10:56 ` Peter Maydell
2021-04-07 19:57 ` [PATCH v4 for-6.0 06/12] esp: ensure cmdfifo is not empty and current_dev is non-NULL Mark Cave-Ayland
2021-04-07 19:57 ` [PATCH v4 for-6.0 07/12] esp: don't underflow cmdfifo in do_cmd() Mark Cave-Ayland
2021-04-07 19:57 ` [PATCH v4 for-6.0 08/12] esp: don't overflow cmdfifo in get_cmd() Mark Cave-Ayland
2021-04-07 19:57 ` [PATCH v4 for-6.0 09/12] esp: don't overflow cmdfifo if TC is larger than the cmdfifo size Mark Cave-Ayland
2021-04-07 19:57 ` [PATCH v4 for-6.0 10/12] esp: don't reset async_len directly in esp_select() if cancelling request Mark Cave-Ayland
2021-04-07 21:25 ` Philippe Mathieu-Daudé
2021-04-07 19:58 ` [PATCH v4 for-6.0 11/12] esp: ensure that do_cmd is set to zero before submitting an ESP select command Mark Cave-Ayland
2021-04-07 21:24 ` Philippe Mathieu-Daudé
2021-04-07 19:58 ` [PATCH v4 for-6.0 12/12] tests/qtest: add tests for am53c974 device Mark Cave-Ayland
2021-04-12 14:53 ` Peter Maydell
2021-04-09 11:39 ` [PATCH v4 for-6.0 00/12] esp: fix asserts/segfaults discovered by fuzzer Mark Cave-Ayland
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=06ed2995-d11d-6c85-49dc-aaf1ad7f552f@amsat.org \
--to=f4bug@amsat.org \
--cc=alxndr@bu.edu \
--cc=laurent@vivier.eu \
--cc=mark.cave-ayland@ilande.co.uk \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.