From: Peter Maydell <peter.maydell@linaro.org>
To: David Gibson <david@gibson.dropbear.id.au>
Cc: aik@ozlabs.ru, qemu-ppc@nongnu.org, groug@kaod.org,
qemu-devel@nongnu.org
Subject: Re: [PULL 22/33] spapr: Implement Open Firmware client interface
Date: Thu, 31 Mar 2022 19:02:28 +0100 [thread overview]
Message-ID: <CAFEAcA9FYeF_QMAs+FkC0hfEKF-N1o+KBNHP10m0uBN+bXuC6g@mail.gmail.com> (raw)
In-Reply-To: <20210709051728.170203-23-david@gibson.dropbear.id.au>
On Fri, 9 Jul 2021 at 06:17, David Gibson <david@gibson.dropbear.id.au> wrote:
>
> From: Alexey Kardashevskiy <aik@ozlabs.ru>
>
> The PAPR platform describes an OS environment that's presented by
> a combination of a hypervisor and firmware. The features it specifies
> require collaboration between the firmware and the hypervisor.
Hi; the latest version of Coverity has pointed out another bug
in this commit (CID 1487241):
> +static uint32_t vof_setprop(MachineState *ms, void *fdt, Vof *vof,
> + uint32_t nodeph, uint32_t pname,
> + uint32_t valaddr, uint32_t vallen)
> +{
> + char propname[OF_PROPNAME_LEN_MAX + 1];
We don't initialize this array...
> + uint32_t ret = -1;
> + int offset;
> + char trval[64] = "";
> + char nodepath[VOF_MAX_PATH] = "";
> + Object *vmo = object_dynamic_cast(OBJECT(ms), TYPE_VOF_MACHINE_IF);
> + g_autofree char *val = NULL;
> +
> + if (vallen > VOF_MAX_SETPROPLEN) {
> + goto trace_exit;
...and this error-exit check happens before the readstr() that
fills in the propname[] array...
> + }
> + if (readstr(pname, propname, sizeof(propname))) {
> + goto trace_exit;
...and if the readstr() fails then propname[] isn't set either...
> + }
> +trace_exit:
> + trace_vof_setprop(nodeph, propname, trval, vallen, ret);
...but on the 'trace_exit' error path we still try to trace
propname, which will use the %s format string on it, printing
a potentially arbitrary amount of garbage.
We should either initialize the propname array or else
not trace it for these error paths.
thanks
-- PMM
next prev parent reply other threads:[~2022-03-31 18:04 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-09 5:16 [PULL 00/33] ppc-for-6.1 queue 20210709 David Gibson
2021-07-09 5:16 ` [PULL 01/33] target/ppc: Introduce ppc_interrupts_little_endian() David Gibson
2021-07-09 5:16 ` [PULL 02/33] target/ppc: Drop PowerPCCPUClass::interrupts_big_endian() David Gibson
2021-07-09 5:16 ` [PULL 03/33] spapr: tune rtas-size David Gibson
2021-07-09 5:16 ` [PULL 04/33] target/ppc: Remove PowerPCCPUClass.handle_mmu_fault David Gibson
2021-07-09 5:17 ` [PULL 05/33] target/ppc: Use MMUAccessType with *_handle_mmu_fault David Gibson
2021-07-09 5:17 ` [PULL 06/33] target/ppc: Push real-mode handling into ppc_radix64_xlate David Gibson
2021-07-09 5:17 ` [PULL 07/33] target/ppc: Use bool success for ppc_radix64_xlate David Gibson
2021-07-09 5:17 ` [PULL 08/33] target/ppc: Split out ppc_hash64_xlate David Gibson
2021-07-09 5:17 ` [PULL 09/33] target/ppc: Split out ppc_hash32_xlate David Gibson
2021-07-09 5:17 ` [PULL 10/33] target/ppc: Split out ppc_jumbo_xlate David Gibson
2021-07-09 5:17 ` [PULL 11/33] target/ppc: Introduce ppc_xlate David Gibson
2021-07-09 5:17 ` [PULL 12/33] target/ppc: Restrict ppc_cpu_tlb_fill to TCG David Gibson
2021-07-09 5:17 ` [PULL 13/33] target/ppc: Fix compilation with DUMP_PAGE_TABLES debug option David Gibson
2021-07-09 5:17 ` [PULL 14/33] target/ppc: Fix compilation with FLUSH_ALL_TLBS " David Gibson
2021-07-09 5:17 ` [PULL 15/33] target/ppc: Fix compilation with DEBUG_BATS " David Gibson
2021-07-09 5:17 ` [PULL 16/33] target/ppc: fix address translation bug for radix mmus David Gibson
2021-07-09 5:17 ` [PULL 17/33] target/ppc: changed ppc_hash64_xlate to use mmu_idx David Gibson
2021-07-09 5:17 ` [PULL 18/33] target/ppc: introduce mmu-books.h David Gibson
2021-07-09 5:17 ` [PULL 19/33] target/ppc: change ppc_hash32_xlate to use mmu_idx David Gibson
2021-07-09 5:17 ` [PULL 20/33] roms/u-boot: Bump ppce500 u-boot to v2021.07 to add eTSEC support David Gibson
2021-07-09 5:17 ` [PULL 21/33] docs/system: ppc: Update ppce500 documentation with " David Gibson
2021-07-09 5:17 ` [PULL 22/33] spapr: Implement Open Firmware client interface David Gibson
2021-07-13 11:01 ` Peter Maydell
2021-07-13 11:09 ` Peter Maydell
2022-03-31 18:02 ` Peter Maydell [this message]
2021-07-09 5:17 ` [PULL 23/33] target/ppc: mtmsrd is an illegal instruction on BookE David Gibson
2021-07-09 5:17 ` [PULL 24/33] ppc/pegasos2: Introduce Pegasos2MachineState structure David Gibson
2021-07-09 5:17 ` [PULL 25/33] target/ppc: Allow virtual hypervisor on CPU without HV David Gibson
2021-07-09 5:17 ` [PULL 26/33] target/ppc/spapr: Update H_GET_CPU_CHARACTERISTICS L1D cache flush bits David Gibson
2021-07-09 5:17 ` [PULL 27/33] ppc/pegasos2: Use Virtual Open Firmware as firmware replacement David Gibson
2021-07-09 5:17 ` [PULL 28/33] ppc/pegasos2: Fix use of && instead of & David Gibson
2021-07-09 5:17 ` [PULL 29/33] ppc/pegasos2: Implement some RTAS functions with VOF David Gibson
2021-07-09 5:17 ` [PULL 30/33] target/ppc: Don't compile ppc_tlb_invalid_all without TCG David Gibson
2021-07-09 5:17 ` [PULL 31/33] spapr: Fix implementation of Open Firmware client interface David Gibson
2021-07-09 5:17 ` [PULL 32/33] linux-headers: Update David Gibson
2021-07-09 5:17 ` [PULL 33/33] target/ppc: Support for H_RPT_INVALIDATE hcall David Gibson
2021-07-10 18:54 ` [PULL 00/33] ppc-for-6.1 queue 20210709 Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAFEAcA9FYeF_QMAs+FkC0hfEKF-N1o+KBNHP10m0uBN+bXuC6g@mail.gmail.com \
--to=peter.maydell@linaro.org \
--cc=aik@ozlabs.ru \
--cc=david@gibson.dropbear.id.au \
--cc=groug@kaod.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-ppc@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).