* [Qemu-devel] [Qemu-devel PATCH v2 0/2] sd: Fix out-of-bounds assertions
@ 2019-06-05 6:21 Lidong Chen
2019-06-05 6:21 ` [Qemu-devel] [Qemu-devel PATCH v2 1/2] " Lidong Chen
2019-06-05 6:21 ` [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion Lidong Chen
0 siblings, 2 replies; 11+ messages in thread
From: Lidong Chen @ 2019-06-05 6:21 UTC (permalink / raw)
To: qemu-devel
Cc: peter.maydell, berrange, liran.alon, liq3ea, armbru, lidong.chen,
darren.kenny, marcandre.lureau, amarkovic, philmd
The v2 changes include the fix for the incorrect assertion for poll_fds
in util/main-loop.c according to the review comments from the previous
sd fixes.
Lidong Chen (2):
sd: Fix out-of-bounds assertions
util/main-loop: Fix incorrect assertion
hw/sd/sd.c | 4 ++--
util/main-loop.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
--
1.8.3.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Qemu-devel] [Qemu-devel PATCH v2 1/2] sd: Fix out-of-bounds assertions
2019-06-05 6:21 [Qemu-devel] [Qemu-devel PATCH v2 0/2] sd: Fix out-of-bounds assertions Lidong Chen
@ 2019-06-05 6:21 ` Lidong Chen
2019-06-05 8:51 ` Philippe Mathieu-Daudé
2019-06-05 6:21 ` [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion Lidong Chen
1 sibling, 1 reply; 11+ messages in thread
From: Lidong Chen @ 2019-06-05 6:21 UTC (permalink / raw)
To: qemu-devel
Cc: peter.maydell, berrange, liran.alon, liq3ea, armbru, lidong.chen,
darren.kenny, marcandre.lureau, amarkovic, philmd
Due to an off-by-one error, the assert statements allow an
out-of-bound array access.
Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
---
hw/sd/sd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index aaab15f..818f86c 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -144,7 +144,7 @@ static const char *sd_state_name(enum SDCardStates state)
if (state == sd_inactive_state) {
return "inactive";
}
- assert(state <= ARRAY_SIZE(state_name));
+ assert(state < ARRAY_SIZE(state_name));
return state_name[state];
}
@@ -165,7 +165,7 @@ static const char *sd_response_name(sd_rsp_type_t rsp)
if (rsp == sd_r1b) {
rsp = sd_r1;
}
- assert(rsp <= ARRAY_SIZE(response_name));
+ assert(rsp < ARRAY_SIZE(response_name));
return response_name[rsp];
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion
2019-06-05 6:21 [Qemu-devel] [Qemu-devel PATCH v2 0/2] sd: Fix out-of-bounds assertions Lidong Chen
2019-06-05 6:21 ` [Qemu-devel] [Qemu-devel PATCH v2 1/2] " Lidong Chen
@ 2019-06-05 6:21 ` Lidong Chen
2019-06-05 6:43 ` Li Qiang
2019-06-05 8:57 ` Philippe Mathieu-Daudé
1 sibling, 2 replies; 11+ messages in thread
From: Lidong Chen @ 2019-06-05 6:21 UTC (permalink / raw)
To: qemu-devel
Cc: peter.maydell, berrange, liran.alon, liq3ea, armbru, lidong.chen,
darren.kenny, marcandre.lureau, amarkovic, philmd
The check for poll_fds in g_assert() was incorrect. The correct assertion
should check "n_poll_fds + w->num <= ARRAY_SIZE(poll_fds)" because the
subsequent for-loop is doing access to poll_fds[n_poll_fds + i] where i
is in [0, w->num).
Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Liran Alon <liran.alon@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
---
util/main-loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/util/main-loop.c b/util/main-loop.c
index e1e349c..a9f4e8d 100644
--- a/util/main-loop.c
+++ b/util/main-loop.c
@@ -422,7 +422,7 @@ static int os_host_main_loop_wait(int64_t timeout)
g_main_context_prepare(context, &max_priority);
n_poll_fds = g_main_context_query(context, max_priority, &poll_timeout,
poll_fds, ARRAY_SIZE(poll_fds));
- g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
+ g_assert(n_poll_fds + w->num <= ARRAY_SIZE(poll_fds));
for (i = 0; i < w->num; i++) {
poll_fds[n_poll_fds + i].fd = (DWORD_PTR)w->events[i];
--
1.8.3.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion
2019-06-05 6:21 ` [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion Lidong Chen
@ 2019-06-05 6:43 ` Li Qiang
2019-06-05 8:57 ` Philippe Mathieu-Daudé
1 sibling, 0 replies; 11+ messages in thread
From: Li Qiang @ 2019-06-05 6:43 UTC (permalink / raw)
To: Lidong Chen
Cc: Peter Maydell, Daniel P. Berrange, liran.alon, Qemu Developers,
Markus Armbruster, Darren Kenny, Marc-André Lureau,
amarkovic, Philippe Mathieu-Daudé
Lidong Chen <lidong.chen@oracle.com> 于2019年6月5日周三 下午2:23写道:
> The check for poll_fds in g_assert() was incorrect. The correct assertion
> should check "n_poll_fds + w->num <= ARRAY_SIZE(poll_fds)" because the
> subsequent for-loop is doing access to poll_fds[n_poll_fds + i] where i
> is in [0, w->num).
>
> Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
> Reviewed-by: Liran Alon <liran.alon@oracle.com>
> Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Thanks,
Li Qiang
> ---
> util/main-loop.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/util/main-loop.c b/util/main-loop.c
> index e1e349c..a9f4e8d 100644
> --- a/util/main-loop.c
> +++ b/util/main-loop.c
> @@ -422,7 +422,7 @@ static int os_host_main_loop_wait(int64_t timeout)
> g_main_context_prepare(context, &max_priority);
> n_poll_fds = g_main_context_query(context, max_priority,
> &poll_timeout,
> poll_fds, ARRAY_SIZE(poll_fds));
> - g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
> + g_assert(n_poll_fds + w->num <= ARRAY_SIZE(poll_fds));
>
> for (i = 0; i < w->num; i++) {
> poll_fds[n_poll_fds + i].fd = (DWORD_PTR)w->events[i];
> --
> 1.8.3.1
>
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [Qemu-devel] [Qemu-devel PATCH v2 1/2] sd: Fix out-of-bounds assertions
2019-06-05 6:21 ` [Qemu-devel] [Qemu-devel PATCH v2 1/2] " Lidong Chen
@ 2019-06-05 8:51 ` Philippe Mathieu-Daudé
0 siblings, 0 replies; 11+ messages in thread
From: Philippe Mathieu-Daudé @ 2019-06-05 8:51 UTC (permalink / raw)
To: Lidong Chen, qemu-devel
Cc: peter.maydell, berrange, liran.alon, liq3ea, armbru,
darren.kenny, marcandre.lureau, amarkovic
On 6/5/19 8:21 AM, Lidong Chen wrote:
> Due to an off-by-one error, the assert statements allow an
> out-of-bound array access.
Not sure via which tree this patch is going (trivial?).
To the maintainer, please consider adding when applying:
"This access can not happen. Fix to silent static analyzer warnings."
As confirmed by Lidong in v1 here:
https://lists.gnu.org/archive/html/qemu-devel/2019-04/msg01337.html
Thanks,
Phil.
> Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
> Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> Reviewed-by: Li Qiang <liq3ea@gmail.com>
> Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
> ---
> hw/sd/sd.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/hw/sd/sd.c b/hw/sd/sd.c
> index aaab15f..818f86c 100644
> --- a/hw/sd/sd.c
> +++ b/hw/sd/sd.c
> @@ -144,7 +144,7 @@ static const char *sd_state_name(enum SDCardStates state)
> if (state == sd_inactive_state) {
> return "inactive";
> }
> - assert(state <= ARRAY_SIZE(state_name));
> + assert(state < ARRAY_SIZE(state_name));
> return state_name[state];
> }
>
> @@ -165,7 +165,7 @@ static const char *sd_response_name(sd_rsp_type_t rsp)
> if (rsp == sd_r1b) {
> rsp = sd_r1;
> }
> - assert(rsp <= ARRAY_SIZE(response_name));
> + assert(rsp < ARRAY_SIZE(response_name));
> return response_name[rsp];
> }
>
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion
2019-06-05 6:21 ` [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion Lidong Chen
2019-06-05 6:43 ` Li Qiang
@ 2019-06-05 8:57 ` Philippe Mathieu-Daudé
2019-06-05 17:25 ` Lidong Chen
1 sibling, 1 reply; 11+ messages in thread
From: Philippe Mathieu-Daudé @ 2019-06-05 8:57 UTC (permalink / raw)
To: Lidong Chen, qemu-devel
Cc: peter.maydell, berrange, liran.alon, liq3ea, armbru,
darren.kenny, marcandre.lureau, amarkovic
This patch doesn't seem related to the series cover.
On 6/5/19 8:21 AM, Lidong Chen wrote:
> The check for poll_fds in g_assert() was incorrect. The correct assertion
> should check "n_poll_fds + w->num <= ARRAY_SIZE(poll_fds)" because the
> subsequent for-loop is doing access to poll_fds[n_poll_fds + i] where i
> is in [0, w->num).
>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
> Reviewed-by: Liran Alon <liran.alon@oracle.com>
> Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
> util/main-loop.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/util/main-loop.c b/util/main-loop.c
> index e1e349c..a9f4e8d 100644
> --- a/util/main-loop.c
> +++ b/util/main-loop.c
> @@ -422,7 +422,7 @@ static int os_host_main_loop_wait(int64_t timeout)
> g_main_context_prepare(context, &max_priority);
> n_poll_fds = g_main_context_query(context, max_priority, &poll_timeout,
> poll_fds, ARRAY_SIZE(poll_fds));
> - g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
> + g_assert(n_poll_fds + w->num <= ARRAY_SIZE(poll_fds));
>
> for (i = 0; i < w->num; i++) {
> poll_fds[n_poll_fds + i].fd = (DWORD_PTR)w->events[i];
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion
2019-06-05 8:57 ` Philippe Mathieu-Daudé
@ 2019-06-05 17:25 ` Lidong Chen
0 siblings, 0 replies; 11+ messages in thread
From: Lidong Chen @ 2019-06-05 17:25 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, qemu-devel
Cc: peter.maydell, berrange, liran.alon, liq3ea, armbru,
darren.kenny, marcandre.lureau, amarkovic
On 6/5/2019 1:57 AM, Philippe Mathieu-Daudé wrote:
> This patch doesn't seem related to the series cover.
I will resent the patch to include more details to the cover.
>
> On 6/5/19 8:21 AM, Lidong Chen wrote:
>> The check for poll_fds in g_assert() was incorrect. The correct assertion
>> should check "n_poll_fds + w->num <= ARRAY_SIZE(poll_fds)" because the
>> subsequent for-loop is doing access to poll_fds[n_poll_fds + i] where i
>> is in [0, w->num).
>>
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Liam Merwick also suggested this fix. So, added him as well.
Thanks,
Lidong
>
>> Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
>> Reviewed-by: Liran Alon <liran.alon@oracle.com>
>> Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
>
>> ---
>> util/main-loop.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/util/main-loop.c b/util/main-loop.c
>> index e1e349c..a9f4e8d 100644
>> --- a/util/main-loop.c
>> +++ b/util/main-loop.c
>> @@ -422,7 +422,7 @@ static int os_host_main_loop_wait(int64_t timeout)
>> g_main_context_prepare(context, &max_priority);
>> n_poll_fds = g_main_context_query(context, max_priority, &poll_timeout,
>> poll_fds, ARRAY_SIZE(poll_fds));
>> - g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
>> + g_assert(n_poll_fds + w->num <= ARRAY_SIZE(poll_fds));
>>
>> for (i = 0; i < w->num; i++) {
>> poll_fds[n_poll_fds + i].fd = (DWORD_PTR)w->events[i];
>>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion
2019-06-06 23:18 ` Philippe Mathieu-Daudé
@ 2019-06-07 21:36 ` Lidong Chen
0 siblings, 0 replies; 11+ messages in thread
From: Lidong Chen @ 2019-06-07 21:36 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, qemu-devel
Cc: peter.maydell, berrange, liran.alon, liq3ea, armbru,
darren.kenny, marcandre.lureau, amarkovic
Hi Philippe,
On 6/6/2019 4:18 PM, Philippe Mathieu-Daudé wrote:
> On 6/5/19 9:15 PM, Lidong Chen wrote:
>> The check for poll_fds in g_assert() was incorrect. The correct assertion
>> should check "n_poll_fds + w->num <= ARRAY_SIZE(poll_fds)" because the
>> subsequent for-loop is doing access to poll_fds[n_poll_fds + i] where i
>> is in [0, w->num).
>>
>> Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
>> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
>> Suggested-by: Liam Merwick <liam.merwick@oracle.com>
> Ah, so this is not a plain "v2 RESEND" patch of
> https://lists.gnu.org/archive/html/qemu-devel/2019-06/msg00636.html
> since you added Peter 'Suggested-by' tag...
So, should I resend it as v3 patch?
>> Reviewed-by: Liran Alon <liran.alon@oracle.com>
>> Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
>> Reviewed-by: Li Qiang <liq3ea@gmail.com>
> ... but then you dropped my 'Reviewed-by'. Assuming this is a typo, and
> since there is no logical change in this patch with the previous one,
> here it goes again:
>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Thanks for catching that! Sorry about it, I will add your 'Reviewed-by'.
Thanks,
Lidong
>
> Regards,
>
> Phil.
>
>> ---
>> util/main-loop.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/util/main-loop.c b/util/main-loop.c
>> index e1e349c..a9f4e8d 100644
>> --- a/util/main-loop.c
>> +++ b/util/main-loop.c
>> @@ -422,7 +422,7 @@ static int os_host_main_loop_wait(int64_t timeout)
>> g_main_context_prepare(context, &max_priority);
>> n_poll_fds = g_main_context_query(context, max_priority, &poll_timeout,
>> poll_fds, ARRAY_SIZE(poll_fds));
>> - g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
>> + g_assert(n_poll_fds + w->num <= ARRAY_SIZE(poll_fds));
>>
>> for (i = 0; i < w->num; i++) {
>> poll_fds[n_poll_fds + i].fd = (DWORD_PTR)w->events[i];
>>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion
2019-06-05 19:15 ` [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion Lidong Chen
2019-06-06 5:27 ` Markus Armbruster
@ 2019-06-06 23:18 ` Philippe Mathieu-Daudé
2019-06-07 21:36 ` Lidong Chen
1 sibling, 1 reply; 11+ messages in thread
From: Philippe Mathieu-Daudé @ 2019-06-06 23:18 UTC (permalink / raw)
To: Lidong Chen, qemu-devel
Cc: peter.maydell, berrange, liran.alon, liq3ea, armbru,
darren.kenny, marcandre.lureau, amarkovic
On 6/5/19 9:15 PM, Lidong Chen wrote:
> The check for poll_fds in g_assert() was incorrect. The correct assertion
> should check "n_poll_fds + w->num <= ARRAY_SIZE(poll_fds)" because the
> subsequent for-loop is doing access to poll_fds[n_poll_fds + i] where i
> is in [0, w->num).
>
> Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Suggested-by: Liam Merwick <liam.merwick@oracle.com>
Ah, so this is not a plain "v2 RESEND" patch of
https://lists.gnu.org/archive/html/qemu-devel/2019-06/msg00636.html
since you added Peter 'Suggested-by' tag...
> Reviewed-by: Liran Alon <liran.alon@oracle.com>
> Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
> Reviewed-by: Li Qiang <liq3ea@gmail.com>
... but then you dropped my 'Reviewed-by'. Assuming this is a typo, and
since there is no logical change in this patch with the previous one,
here it goes again:
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Regards,
Phil.
> ---
> util/main-loop.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/util/main-loop.c b/util/main-loop.c
> index e1e349c..a9f4e8d 100644
> --- a/util/main-loop.c
> +++ b/util/main-loop.c
> @@ -422,7 +422,7 @@ static int os_host_main_loop_wait(int64_t timeout)
> g_main_context_prepare(context, &max_priority);
> n_poll_fds = g_main_context_query(context, max_priority, &poll_timeout,
> poll_fds, ARRAY_SIZE(poll_fds));
> - g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
> + g_assert(n_poll_fds + w->num <= ARRAY_SIZE(poll_fds));
>
> for (i = 0; i < w->num; i++) {
> poll_fds[n_poll_fds + i].fd = (DWORD_PTR)w->events[i];
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion
2019-06-05 19:15 ` [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion Lidong Chen
@ 2019-06-06 5:27 ` Markus Armbruster
2019-06-06 23:18 ` Philippe Mathieu-Daudé
1 sibling, 0 replies; 11+ messages in thread
From: Markus Armbruster @ 2019-06-06 5:27 UTC (permalink / raw)
To: Lidong Chen
Cc: peter.maydell, berrange, liq3ea, qemu-devel, armbru,
darren.kenny, liran.alon, amarkovic, Paolo Bonzini,
marcandre.lureau, philmd
You neglected to cc: the file's maintainer. I'm doing that for you now.
In the future, use scripts/get_maintainer.pl to find maintainers you
might want to cc:.
Lidong Chen <lidong.chen@oracle.com> writes:
> The check for poll_fds in g_assert() was incorrect. The correct assertion
> should check "n_poll_fds + w->num <= ARRAY_SIZE(poll_fds)" because the
> subsequent for-loop is doing access to poll_fds[n_poll_fds + i] where i
> is in [0, w->num).
>
> Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
> Suggested-by: Peter Maydell <peter.maydell@linaro.org>
> Suggested-by: Liam Merwick <liam.merwick@oracle.com>
> Reviewed-by: Liran Alon <liran.alon@oracle.com>
> Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
> Reviewed-by: Li Qiang <liq3ea@gmail.com>
> ---
> util/main-loop.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/util/main-loop.c b/util/main-loop.c
> index e1e349c..a9f4e8d 100644
> --- a/util/main-loop.c
> +++ b/util/main-loop.c
> @@ -422,7 +422,7 @@ static int os_host_main_loop_wait(int64_t timeout)
> g_main_context_prepare(context, &max_priority);
> n_poll_fds = g_main_context_query(context, max_priority, &poll_timeout,
> poll_fds, ARRAY_SIZE(poll_fds));
> - g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
> + g_assert(n_poll_fds + w->num <= ARRAY_SIZE(poll_fds));
>
> for (i = 0; i < w->num; i++) {
> poll_fds[n_poll_fds + i].fd = (DWORD_PTR)w->events[i];
^ permalink raw reply [flat|nested] 11+ messages in thread
* [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion
2019-06-05 19:15 [Qemu-devel] [Qemu-devel PATCH v2 0/2] Fix incorrect assertions in sd and main-loop Lidong Chen
@ 2019-06-05 19:15 ` Lidong Chen
2019-06-06 5:27 ` Markus Armbruster
2019-06-06 23:18 ` Philippe Mathieu-Daudé
0 siblings, 2 replies; 11+ messages in thread
From: Lidong Chen @ 2019-06-05 19:15 UTC (permalink / raw)
To: qemu-devel
Cc: peter.maydell, berrange, liran.alon, liq3ea, armbru, lidong.chen,
darren.kenny, marcandre.lureau, amarkovic, philmd
The check for poll_fds in g_assert() was incorrect. The correct assertion
should check "n_poll_fds + w->num <= ARRAY_SIZE(poll_fds)" because the
subsequent for-loop is doing access to poll_fds[n_poll_fds + i] where i
is in [0, w->num).
Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Suggested-by: Liam Merwick <liam.merwick@oracle.com>
Reviewed-by: Liran Alon <liran.alon@oracle.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
---
util/main-loop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/util/main-loop.c b/util/main-loop.c
index e1e349c..a9f4e8d 100644
--- a/util/main-loop.c
+++ b/util/main-loop.c
@@ -422,7 +422,7 @@ static int os_host_main_loop_wait(int64_t timeout)
g_main_context_prepare(context, &max_priority);
n_poll_fds = g_main_context_query(context, max_priority, &poll_timeout,
poll_fds, ARRAY_SIZE(poll_fds));
- g_assert(n_poll_fds <= ARRAY_SIZE(poll_fds));
+ g_assert(n_poll_fds + w->num <= ARRAY_SIZE(poll_fds));
for (i = 0; i < w->num; i++) {
poll_fds[n_poll_fds + i].fd = (DWORD_PTR)w->events[i];
--
1.8.3.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
end of thread, other threads:[~2019-06-07 21:38 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-05 6:21 [Qemu-devel] [Qemu-devel PATCH v2 0/2] sd: Fix out-of-bounds assertions Lidong Chen
2019-06-05 6:21 ` [Qemu-devel] [Qemu-devel PATCH v2 1/2] " Lidong Chen
2019-06-05 8:51 ` Philippe Mathieu-Daudé
2019-06-05 6:21 ` [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion Lidong Chen
2019-06-05 6:43 ` Li Qiang
2019-06-05 8:57 ` Philippe Mathieu-Daudé
2019-06-05 17:25 ` Lidong Chen
2019-06-05 19:15 [Qemu-devel] [Qemu-devel PATCH v2 0/2] Fix incorrect assertions in sd and main-loop Lidong Chen
2019-06-05 19:15 ` [Qemu-devel] [Qemu-devel PATCH v2 2/2] util/main-loop: Fix incorrect assertion Lidong Chen
2019-06-06 5:27 ` Markus Armbruster
2019-06-06 23:18 ` Philippe Mathieu-Daudé
2019-06-07 21:36 ` Lidong Chen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.