KVM Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH kvm-unit-tests] fw_cfg: avoid index out of bounds
@ 2020-07-30 21:58 Paolo Bonzini
  2020-07-31 16:00 ` Nadav Amit
  0 siblings, 1 reply; 3+ messages in thread
From: Paolo Bonzini @ 2020-07-30 21:58 UTC (permalink / raw)
  To: kvm

clang compilation fails with

lib/x86/fwcfg.c:32:3: error: array index 17 is past the end of the array (which contains 16 elements) [-Werror,-Warray-bounds]
                fw_override[FW_CFG_MAX_RAM] = atol(str) * 1024 * 1024;

The reason is that FW_CFG_MAX_RAM does not exist in the fw-cfg spec and was
added for bare metal support.  Fix the size of the array and rename FW_CFG_MAX_ENTRY
to FW_CFG_NUM_ENTRIES, so that it is clear that it must be one plus the
highest valid entry.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 lib/x86/fwcfg.c | 6 +++---
 lib/x86/fwcfg.h | 5 ++++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/lib/x86/fwcfg.c b/lib/x86/fwcfg.c
index c2aaf5a..1734afb 100644
--- a/lib/x86/fwcfg.c
+++ b/lib/x86/fwcfg.c
@@ -4,7 +4,7 @@
 
 static struct spinlock lock;
 
-static long fw_override[FW_CFG_MAX_ENTRY];
+static long fw_override[FW_CFG_NUM_ENTRIES];
 static bool fw_override_done;
 
 bool no_test_device;
@@ -15,7 +15,7 @@ static void read_cfg_override(void)
 	int i;
 
 	/* Initialize to negative value that would be considered as invalid */
-	for (i = 0; i < FW_CFG_MAX_ENTRY; i++)
+	for (i = 0; i < FW_CFG_NUM_ENTRIES; i++)
 		fw_override[i] = -1;
 
 	if ((str = getenv("NR_CPUS")))
@@ -44,7 +44,7 @@ static uint64_t fwcfg_get_u(uint16_t index, int bytes)
     if (!fw_override_done)
         read_cfg_override();
 
-    if (index < FW_CFG_MAX_ENTRY && fw_override[index] >= 0)
+    if (index < FW_CFG_NUM_ENTRIES && fw_override[index] >= 0)
 	    return fw_override[index];
 
     spin_lock(&lock);
diff --git a/lib/x86/fwcfg.h b/lib/x86/fwcfg.h
index 64d4c6e..ac4257e 100644
--- a/lib/x86/fwcfg.h
+++ b/lib/x86/fwcfg.h
@@ -20,9 +20,12 @@
 #define FW_CFG_NUMA             0x0d
 #define FW_CFG_BOOT_MENU        0x0e
 #define FW_CFG_MAX_CPUS         0x0f
-#define FW_CFG_MAX_ENTRY        0x10
+
+/* Dummy entries used when running on bare metal */
 #define FW_CFG_MAX_RAM		0x11
 
+#define FW_CFG_NUM_ENTRIES      (FW_CFG_MAX_RAM + 1)
+
 #define FW_CFG_WRITE_CHANNEL    0x4000
 #define FW_CFG_ARCH_LOCAL       0x8000
 #define FW_CFG_ENTRY_MASK       ~(FW_CFG_WRITE_CHANNEL | FW_CFG_ARCH_LOCAL)
-- 
2.26.2


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH kvm-unit-tests] fw_cfg: avoid index out of bounds
  2020-07-30 21:58 [PATCH kvm-unit-tests] fw_cfg: avoid index out of bounds Paolo Bonzini
@ 2020-07-31 16:00 ` Nadav Amit
  2020-07-31 16:05   ` Paolo Bonzini
  0 siblings, 1 reply; 3+ messages in thread
From: Nadav Amit @ 2020-07-31 16:00 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: kvm

> 
> On Jul 30, 2020, at 2:58 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> 
> clang compilation fails with
> 
> lib/x86/fwcfg.c:32:3: error: array index 17 is past the end of the array (which contains 16 elements) [-Werror,-Warray-bounds]
>                fw_override[FW_CFG_MAX_RAM] = atol(str) * 1024 * 1024;
> 
> The reason is that FW_CFG_MAX_RAM does not exist in the fw-cfg spec and was
> added for bare metal support.  Fix the size of the array and rename FW_CFG_MAX_ENTRY
> to FW_CFG_NUM_ENTRIES, so that it is clear that it must be one plus the
> highest valid entry.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
> lib/x86/fwcfg.c | 6 +++---
> lib/x86/fwcfg.h | 5 ++++-
> 2 files changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/lib/x86/fwcfg.c b/lib/x86/fwcfg.c
> index c2aaf5a..1734afb 100644
> --- a/lib/x86/fwcfg.c
> +++ b/lib/x86/fwcfg.c
> @@ -4,7 +4,7 @@
> 
> static struct spinlock lock;
> 
> -static long fw_override[FW_CFG_MAX_ENTRY];
> +static long fw_override[FW_CFG_NUM_ENTRIES];
> static bool fw_override_done;
> 
> bool no_test_device;
> @@ -15,7 +15,7 @@ static void read_cfg_override(void)
> 	int i;
> 
> 	/* Initialize to negative value that would be considered as invalid */
> -	for (i = 0; i < FW_CFG_MAX_ENTRY; i++)
> +	for (i = 0; i < FW_CFG_NUM_ENTRIES; i++)
> 		fw_override[i] = -1;
> 
> 	if ((str = getenv("NR_CPUS")))
> @@ -44,7 +44,7 @@ static uint64_t fwcfg_get_u(uint16_t index, int bytes)
>     if (!fw_override_done)
>         read_cfg_override();
> 
> -    if (index < FW_CFG_MAX_ENTRY && fw_override[index] >= 0)
> +    if (index < FW_CFG_NUM_ENTRIES && fw_override[index] >= 0)
> 	    return fw_override[index];
> 
>     spin_lock(&lock);
> diff --git a/lib/x86/fwcfg.h b/lib/x86/fwcfg.h
> index 64d4c6e..ac4257e 100644
> --- a/lib/x86/fwcfg.h
> +++ b/lib/x86/fwcfg.h
> @@ -20,9 +20,12 @@
> #define FW_CFG_NUMA             0x0d
> #define FW_CFG_BOOT_MENU        0x0e
> #define FW_CFG_MAX_CPUS         0x0f
> -#define FW_CFG_MAX_ENTRY        0x10
> +
> +/* Dummy entries used when running on bare metal */
> #define FW_CFG_MAX_RAM		0x11
> 
> +#define FW_CFG_NUM_ENTRIES      (FW_CFG_MAX_RAM + 1)
> +
> #define FW_CFG_WRITE_CHANNEL    0x4000
> #define FW_CFG_ARCH_LOCAL       0x8000
> #define FW_CFG_ENTRY_MASK       ~(FW_CFG_WRITE_CHANNEL | FW_CFG_ARCH_LOCAL)
> — 
> 2.26.2

For the record: I did send a patch more than two weeks ago to fix this
problem (that I created).


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH kvm-unit-tests] fw_cfg: avoid index out of bounds
  2020-07-31 16:00 ` Nadav Amit
@ 2020-07-31 16:05   ` Paolo Bonzini
  0 siblings, 0 replies; 3+ messages in thread
From: Paolo Bonzini @ 2020-07-31 16:05 UTC (permalink / raw)
  To: Nadav Amit; +Cc: kvm

On 31/07/20 18:00, Nadav Amit wrote:
>>
>> On Jul 30, 2020, at 2:58 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>>
>> clang compilation fails with
>>
>> lib/x86/fwcfg.c:32:3: error: array index 17 is past the end of the array (which contains 16 elements) [-Werror,-Warray-bounds]
>>                fw_override[FW_CFG_MAX_RAM] = atol(str) * 1024 * 1024;
>>
>> The reason is that FW_CFG_MAX_RAM does not exist in the fw-cfg spec and was
>> added for bare metal support.  Fix the size of the array and rename FW_CFG_MAX_ENTRY
>> to FW_CFG_NUM_ENTRIES, so that it is clear that it must be one plus the
>> highest valid entry.
>>
>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>> ---
>> lib/x86/fwcfg.c | 6 +++---
>> lib/x86/fwcfg.h | 5 ++++-
>> 2 files changed, 7 insertions(+), 4 deletions(-)
>>
>> diff --git a/lib/x86/fwcfg.c b/lib/x86/fwcfg.c
>> index c2aaf5a..1734afb 100644
>> --- a/lib/x86/fwcfg.c
>> +++ b/lib/x86/fwcfg.c
>> @@ -4,7 +4,7 @@
>>
>> static struct spinlock lock;
>>
>> -static long fw_override[FW_CFG_MAX_ENTRY];
>> +static long fw_override[FW_CFG_NUM_ENTRIES];
>> static bool fw_override_done;
>>
>> bool no_test_device;
>> @@ -15,7 +15,7 @@ static void read_cfg_override(void)
>> 	int i;
>>
>> 	/* Initialize to negative value that would be considered as invalid */
>> -	for (i = 0; i < FW_CFG_MAX_ENTRY; i++)
>> +	for (i = 0; i < FW_CFG_NUM_ENTRIES; i++)
>> 		fw_override[i] = -1;
>>
>> 	if ((str = getenv("NR_CPUS")))
>> @@ -44,7 +44,7 @@ static uint64_t fwcfg_get_u(uint16_t index, int bytes)
>>     if (!fw_override_done)
>>         read_cfg_override();
>>
>> -    if (index < FW_CFG_MAX_ENTRY && fw_override[index] >= 0)
>> +    if (index < FW_CFG_NUM_ENTRIES && fw_override[index] >= 0)
>> 	    return fw_override[index];
>>
>>     spin_lock(&lock);
>> diff --git a/lib/x86/fwcfg.h b/lib/x86/fwcfg.h
>> index 64d4c6e..ac4257e 100644
>> --- a/lib/x86/fwcfg.h
>> +++ b/lib/x86/fwcfg.h
>> @@ -20,9 +20,12 @@
>> #define FW_CFG_NUMA             0x0d
>> #define FW_CFG_BOOT_MENU        0x0e
>> #define FW_CFG_MAX_CPUS         0x0f
>> -#define FW_CFG_MAX_ENTRY        0x10
>> +
>> +/* Dummy entries used when running on bare metal */
>> #define FW_CFG_MAX_RAM		0x11
>>
>> +#define FW_CFG_NUM_ENTRIES      (FW_CFG_MAX_RAM + 1)
>> +
>> #define FW_CFG_WRITE_CHANNEL    0x4000
>> #define FW_CFG_ARCH_LOCAL       0x8000
>> #define FW_CFG_ENTRY_MASK       ~(FW_CFG_WRITE_CHANNEL | FW_CFG_ARCH_LOCAL)
>> — 
>> 2.26.2
> 
> For the record: I did send a patch more than two weeks ago to fix this
> problem (that I created).

Oops, sorry.  I just saw it on the gitlab CI, I must have missed your patch.

Paolo


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-30 21:58 [PATCH kvm-unit-tests] fw_cfg: avoid index out of bounds Paolo Bonzini
2020-07-31 16:00 ` Nadav Amit
2020-07-31 16:05   ` Paolo Bonzini

KVM Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/kvm/0 kvm/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 kvm kvm/ https://lore.kernel.org/kvm \
		kvm@vger.kernel.org
	public-inbox-index kvm

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.kvm


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git