From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48869C433B4 for ; Mon, 12 Apr 2021 10:58:41 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 9C98761074 for ; Mon, 12 Apr 2021 10:58:40 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9C98761074 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:45680 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lVuH9-0002D6-MS for qemu-devel@archiver.kernel.org; Mon, 12 Apr 2021 06:58:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:39932) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lVuGM-0001mj-Uo for qemu-devel@nongnu.org; Mon, 12 Apr 2021 06:57:50 -0400 Received: from mail-ej1-x636.google.com ([2a00:1450:4864:20::636]:40656) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lVuGK-0007cW-I4 for qemu-devel@nongnu.org; Mon, 12 Apr 2021 06:57:50 -0400 Received: by mail-ej1-x636.google.com with SMTP id n2so19493685ejy.7 for ; Mon, 12 Apr 2021 03:57:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=M5zFLxIy42+ES/YBiJE3zF1p/FVV4cQad69fb7FiB2Q=; b=czCwzfwFkwE62FverTne7skMDk40P/DCy0GesfulJZ8SWDDVbqwP1IeO5uv0G7zRY3 IYxLPua7uZyDf5mSgHBnRHX4plFXmvuSY0ptoe68EBmnPCe6Ps7Oe4u6sDsYUhMG6Anc UEzxHuwe1StLliQ8Hulbt3EUb0I+HrbTL5mmzESGXeif59HU60k+4NH/W0q77dlkg+xz F0rwSVz3sVnN5dod1FwC8wC2Zhqxs9zLKGoHSGrnj/do8H6Y/n3RiLeBtB0zeT5YgAkg btKzsCZzSze9O8HZ/1lsfktSIFP/ufAEPDQFY/7m9PBR73V/qkFlEKQ3zZFeVRDq9jc5 042w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=M5zFLxIy42+ES/YBiJE3zF1p/FVV4cQad69fb7FiB2Q=; b=PPNCF7WSteDgimYlkxo/D6Qsqvh3BhbilaCwEpP531Raq2bfJKRPq6I8feuKauwKQN F2il4ySoNMBSTgQlxeNSqfUhVHN4b3ydk1Eh/7H9TBrhaO1URdxCtotkitsl6LSWIgS+ ShgawWMw8F38SXzKOBjwG8ecW0MlWIivFBQhzZt/5SR7U5kAegZ24hBqvkY7XUHvnSg2 NDTdEB2jH8C3jsx2ZO33P0755yXbng6x6JJPiSSdIhZnLm/4+/o2EZYhUO3hCe94bscC +edPki4tAsbj9PvGLeimkKuriBKSVraX6OQ/me8WFjI3SHaBEfPBT2ZLlTH1y3+seCT/ 6UgQ== X-Gm-Message-State: AOAM5324mrTR/vU28Fsn4qfdvrMDyEMtqwVHDYUqcQanTak9GE8bRAnE 4l5tEHpgSvHW+NmLBOinOGOLRZb5zfjw+9pts2uztg== X-Google-Smtp-Source: ABdhPJw7ykcWmeTO5lKO7VR8mWsuf/99cBK+y4pu1JLlYqkc8HFCOxb1yPDzfI7pU8BACkf1cxmMgp1pu1XoEDd54p8= X-Received: by 2002:a17:907:629e:: with SMTP id nd30mr26713880ejc.407.1618225063950; Mon, 12 Apr 2021 03:57:43 -0700 (PDT) MIME-Version: 1.0 References: <20210407195801.685-1-mark.cave-ayland@ilande.co.uk> <20210407195801.685-6-mark.cave-ayland@ilande.co.uk> In-Reply-To: <20210407195801.685-6-mark.cave-ayland@ilande.co.uk> From: Peter Maydell Date: Mon, 12 Apr 2021 11:56:59 +0100 Message-ID: Subject: Re: [PATCH v4 for-6.0 05/12] esp: introduce esp_fifo_pop_buf() and use it instead of fifo8_pop_buf() To: Mark Cave-Ayland Content-Type: text/plain; charset="UTF-8" Received-SPF: pass client-ip=2a00:1450:4864:20::636; envelope-from=peter.maydell@linaro.org; helo=mail-ej1-x636.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Alexander Bulekov , Paolo Bonzini , QEMU Developers , Laurent Vivier Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" On Wed, 7 Apr 2021 at 21:02, Mark Cave-Ayland wrote: > > The const pointer returned by fifo8_pop_buf() lies directly within the array used > to model the FIFO. Building with address sanitizers enabled shows that if the > caller expects a minimum number of bytes present then if the FIFO is nearly full, > the caller may unexpectedly access past the end of the array. > > Introduce esp_fifo_pop_buf() which takes a destination buffer and performs a > memcpy() in it to guarantee that the caller cannot overwrite the FIFO array and > update all callers to use it. Similarly add underflow protection similar to > esp_fifo_push() and esp_fifo_pop() so that instead of triggering an assert() > the operation becomes a no-op. > > Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 > Signed-off-by: Mark Cave-Ayland > Tested-by: Alexander Bulekov > --- > hw/scsi/esp.c | 40 ++++++++++++++++++++++++++++------------ > 1 file changed, 28 insertions(+), 12 deletions(-) > > diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c > index ff8fa73de9..1aa2caf57d 100644 > --- a/hw/scsi/esp.c > +++ b/hw/scsi/esp.c > @@ -117,6 +117,23 @@ static uint8_t esp_fifo_pop(Fifo8 *fifo) > return fifo8_pop(fifo); > } > > +static uint32_t esp_fifo_pop_buf(Fifo8 *fifo, uint8_t *dest, int maxlen) > +{ > + const uint8_t *buf; > + uint32_t n; > + > + if (maxlen == 0) { > + return 0; > + } > + > + buf = fifo8_pop_buf(fifo, maxlen, &n); > + if (dest) { > + memcpy(dest, buf, n); > + } > + > + return n; > +} > + > static uint32_t esp_get_tc(ESPState *s) > { > uint32_t dmalen; > @@ -241,11 +258,11 @@ static uint32_t get_cmd(ESPState *s, uint32_t maxlen) > if (dmalen == 0) { > return 0; > } > - memcpy(buf, fifo8_pop_buf(&s->fifo, dmalen, &n), dmalen); > - if (dmalen >= 3) { > + n = esp_fifo_pop_buf(&s->fifo, buf, dmalen); > + if (n >= 3) { > buf[0] = buf[2] >> 5; > } > - fifo8_push_all(&s->cmdfifo, buf, dmalen); > + fifo8_push_all(&s->cmdfifo, buf, n); > } > trace_esp_get_cmd(dmalen, target); This bit could be tidied up further -- it currently sets dmalen = MIN(fifo8_num_used(&s->fifo), maxlen); in order not to pull more bytes out of the FIFO than it has in it; but now we are making that check in esp_fifo_pop_buf() I think you could just do dmalen = esp_fifo_pop_buf(&s->fifo, buf, maxlen); and drop the dmalen = MIN(fifo8_num_used(&s->fifo), maxlen); if (dmalen == 0) { return 0; } part and the use of 'n' entirely. But this code isn't wrong, so we can do that later to avoid having to respin here. Reviewed-by: Peter Maydell thanks -- PMM