* [PATCH v3] exec: set map length to zero when returning NULL
@ 2020-05-26 7:50 P J P
2020-05-26 8:01 ` Philippe Mathieu-Daudé
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: P J P @ 2020-05-26 7:50 UTC (permalink / raw)
To: Paolo Bonzini
Cc: Fam Zheng, Prasad J Pandit, QEMU Developers, Alexander Bulekov,
Ding Ren, Marc-André Lureau, Philippe Mathieu-Daudé
From: Prasad J Pandit <pjp@fedoraproject.org>
When mapping physical memory into host's virtual address space,
'address_space_map' may return NULL if BounceBuffer is in_use.
Set and return '*plen = 0' to avoid later NULL pointer dereference.
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: https://bugs.launchpad.net/qemu/+bug/1878259
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
exec.c | 1 +
1 file changed, 1 insertion(+)
Update v3: set *plen = 0;
-> https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06249.html
diff --git a/exec.c b/exec.c
index 5162f0d12f..4eea84bf66 100644
--- a/exec.c
+++ b/exec.c
@@ -3538,6 +3538,7 @@ void *address_space_map(AddressSpace *as,
if (!memory_access_is_direct(mr, is_write)) {
if (atomic_xchg(&bounce.in_use, true)) {
+ *plen = 0;
return NULL;
}
/* Avoid unbounded allocations */
--
2.26.2
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v3] exec: set map length to zero when returning NULL
2020-05-26 7:50 [PATCH v3] exec: set map length to zero when returning NULL P J P
@ 2020-05-26 8:01 ` Philippe Mathieu-Daudé
2020-05-26 10:06 ` Philippe Mathieu-Daudé
2020-05-26 10:19 ` Peter Maydell
2 siblings, 0 replies; 5+ messages in thread
From: Philippe Mathieu-Daudé @ 2020-05-26 8:01 UTC (permalink / raw)
To: P J P, Paolo Bonzini
Cc: Fam Zheng, Prasad J Pandit, QEMU Developers, Alexander Bulekov,
Ding Ren, Marc-André Lureau
On 5/26/20 9:50 AM, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> When mapping physical memory into host's virtual address space,
> 'address_space_map' may return NULL if BounceBuffer is in_use.
> Set and return '*plen = 0' to avoid later NULL pointer dereference.
>
> Reported-by: Alexander Bulekov <alxndr@bu.edu>
> Fixes: https://bugs.launchpad.net/qemu/+bug/1878259
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
> exec.c | 1 +
> 1 file changed, 1 insertion(+)
>
> Update v3: set *plen = 0;
> -> https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06249.html
>
> diff --git a/exec.c b/exec.c
> index 5162f0d12f..4eea84bf66 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -3538,6 +3538,7 @@ void *address_space_map(AddressSpace *as,
>
> if (!memory_access_is_direct(mr, is_write)) {
> if (atomic_xchg(&bounce.in_use, true)) {
> + *plen = 0;
> return NULL;
> }
> /* Avoid unbounded allocations */
>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v3] exec: set map length to zero when returning NULL
2020-05-26 7:50 [PATCH v3] exec: set map length to zero when returning NULL P J P
2020-05-26 8:01 ` Philippe Mathieu-Daudé
@ 2020-05-26 10:06 ` Philippe Mathieu-Daudé
2020-05-26 10:19 ` Peter Maydell
2 siblings, 0 replies; 5+ messages in thread
From: Philippe Mathieu-Daudé @ 2020-05-26 10:06 UTC (permalink / raw)
To: P J P
Cc: Fam Zheng, Prasad J Pandit, QEMU Developers, Alexander Bulekov,
Marc-André Lureau, Ding Ren, Paolo Bonzini
On Tue, May 26, 2020 at 9:53 AM P J P <ppandit@redhat.com> wrote:
>
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> When mapping physical memory into host's virtual address space,
> 'address_space_map' may return NULL if BounceBuffer is in_use.
> Set and return '*plen = 0' to avoid later NULL pointer dereference.
>
> Reported-by: Alexander Bulekov <alxndr@bu.edu>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
> Fixes: https://bugs.launchpad.net/qemu/+bug/1878259
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
> ---
> exec.c | 1 +
> 1 file changed, 1 insertion(+)
>
> Update v3: set *plen = 0;
> -> https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06249.html
>
> diff --git a/exec.c b/exec.c
> index 5162f0d12f..4eea84bf66 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -3538,6 +3538,7 @@ void *address_space_map(AddressSpace *as,
>
> if (!memory_access_is_direct(mr, is_write)) {
> if (atomic_xchg(&bounce.in_use, true)) {
> + *plen = 0;
> return NULL;
> }
> /* Avoid unbounded allocations */
> --
> 2.26.2
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v3] exec: set map length to zero when returning NULL
2020-05-26 7:50 [PATCH v3] exec: set map length to zero when returning NULL P J P
2020-05-26 8:01 ` Philippe Mathieu-Daudé
2020-05-26 10:06 ` Philippe Mathieu-Daudé
@ 2020-05-26 10:19 ` Peter Maydell
2020-05-26 11:18 ` P J P
2 siblings, 1 reply; 5+ messages in thread
From: Peter Maydell @ 2020-05-26 10:19 UTC (permalink / raw)
To: P J P
Cc: Fam Zheng, Prasad J Pandit, QEMU Developers, Alexander Bulekov,
Marc-André Lureau, Ding Ren, Paolo Bonzini,
Philippe Mathieu-Daudé
On Tue, 26 May 2020 at 08:53, P J P <ppandit@redhat.com> wrote:
>
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> When mapping physical memory into host's virtual address space,
> 'address_space_map' may return NULL if BounceBuffer is in_use.
> Set and return '*plen = 0' to avoid later NULL pointer dereference.
>
> Reported-by: Alexander Bulekov <alxndr@bu.edu>
> Fixes: https://bugs.launchpad.net/qemu/+bug/1878259
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
The doc comment for this function in include/exec/memory.h
currently says
"May return %NULL if resources needed to perform the mapping
are exhausted."
If we're tightening the API to guarantee to also set *plen to 0
in this failure case it would be good to capture that in the
documentation, eg:
"May return %NULL (and set *@plen to 0) if resources needed
to perform the mapping are exhausted.)"
thanks
-- PMM
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v3] exec: set map length to zero when returning NULL
2020-05-26 10:19 ` Peter Maydell
@ 2020-05-26 11:18 ` P J P
0 siblings, 0 replies; 5+ messages in thread
From: P J P @ 2020-05-26 11:18 UTC (permalink / raw)
To: Peter Maydell
Cc: Fam Zheng, QEMU Developers, Alexander Bulekov,
Marc-André Lureau, Ding Ren, Paolo Bonzini,
Philippe Mathieu-Daudé
+-- On Tue, 26 May 2020, Peter Maydell wrote --+
| The doc comment for this function in include/exec/memory.h currently says
|
| "May return %NULL if resources needed to perform the mapping
| are exhausted."
|
| If we're tightening the API to guarantee to also set *plen to 0 in this
| failure case it would be good to capture that in the documentation, eg:
|
| "May return %NULL (and set *@plen to 0) if resources needed
| to perform the mapping are exhausted.)"
Sending patch v4. Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-05-26 11:21 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-26 7:50 [PATCH v3] exec: set map length to zero when returning NULL P J P
2020-05-26 8:01 ` Philippe Mathieu-Daudé
2020-05-26 10:06 ` Philippe Mathieu-Daudé
2020-05-26 10:19 ` Peter Maydell
2020-05-26 11:18 ` P J P
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.