All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Philippe Mathieu-Daudé" <philmd@linaro.org>
To: qemu-devel@nongnu.org
Cc: "Philippe Mathieu-Daudé" <philmd@linaro.org>,
	qemu-stable@nongnu.org, "Zheyu Ma" <zheyuma97@gmail.com>,
	"zhenwei pi" <pizhenwei@bytedance.com>,
	"Gonglei (Arei)" <arei.gonglei@huawei.com>
Subject: [PULL 11/16] backends/cryptodev: Do not abort for invalid session ID
Date: Wed, 10 Apr 2024 11:13:10 +0200	[thread overview]
Message-ID: <20240410091315.57241-12-philmd@linaro.org> (raw)
In-Reply-To: <20240410091315.57241-1-philmd@linaro.org>

Instead of aborting when a session ID is invalid,
return VIRTIO_CRYPTO_INVSESS ("Invalid session id").

Reproduced using:

  $ cat << EOF | qemu-system-i386 -display none \
     -machine q35,accel=qtest -m 512M -nodefaults \
     -object cryptodev-backend-builtin,id=cryptodev0 \
     -device virtio-crypto-pci,id=crypto0,cryptodev=cryptodev0 \
     -qtest stdio
  outl 0xcf8 0x80000804
  outw 0xcfc 0x06
  outl 0xcf8 0x80000820
  outl 0xcfc 0xe0008000
  write 0x10800e 0x1 0x01
  write 0xe0008016 0x1 0x01
  write 0xe0008020 0x4 0x00801000
  write 0xe0008028 0x4 0x00c01000
  write 0xe000801c 0x1 0x01
  write 0x110000 0x1 0x05
  write 0x110001 0x1 0x04
  write 0x108002 0x1 0x11
  write 0x108008 0x1 0x48
  write 0x10800c 0x1 0x01
  write 0x108018 0x1 0x10
  write 0x10801c 0x1 0x02
  write 0x10c002 0x1 0x01
  write 0xe000b005 0x1 0x00
  EOF
  Assertion failed: (session_id < MAX_NUM_SESSIONS && builtin->sessions[session_id]),
  function cryptodev_builtin_close_session, file cryptodev-builtin.c, line 430.

Cc: qemu-stable@nongnu.org
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2274
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: zhenwei pi <pizhenwei@bytedance.com>
Message-Id: <20240409094757.9127-1-philmd@linaro.org>
---
 backends/cryptodev-builtin.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/backends/cryptodev-builtin.c b/backends/cryptodev-builtin.c
index 39d0455280..a514bbb310 100644
--- a/backends/cryptodev-builtin.c
+++ b/backends/cryptodev-builtin.c
@@ -427,7 +427,9 @@ static int cryptodev_builtin_close_session(
                       CRYPTODEV_BACKEND_BUILTIN(backend);
     CryptoDevBackendBuiltinSession *session;
 
-    assert(session_id < MAX_NUM_SESSIONS && builtin->sessions[session_id]);
+    if (session_id >= MAX_NUM_SESSIONS || !builtin->sessions[session_id]) {
+        return -VIRTIO_CRYPTO_INVSESS;
+    }
 
     session = builtin->sessions[session_id];
     if (session->cipher) {
-- 
2.41.0



  parent reply	other threads:[~2024-04-10  9:16 UTC|newest]

Thread overview: 18+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-04-10  9:12 [PULL 00/16] Misc HW patches for 2024-04-10 Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 01/16] hw/virtio: Introduce virtio_bh_new_guarded() helper Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 02/16] hw/display/virtio-gpu: Protect from DMA re-entrancy bugs Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 03/16] hw/char/virtio-serial-bus: " Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 04/16] hw/virtio/virtio-crypto: " Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 05/16] qemu-options: Fix CXL Fixed Memory Window interleave-granularity typo Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 06/16] hw/block/nand: Factor nand_load_iolen() method out Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 07/16] hw/block/nand: Have blk_load() take unsigned offset and return boolean Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 08/16] hw/block/nand: Fix out-of-bound access in NAND block buffer Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 09/16] hw/misc/applesmc: Do not call DeviceReset from DeviceRealize Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 10/16] hw/misc/applesmc: Fix memory leak in reset() handler Philippe Mathieu-Daudé
2024-04-10  9:13 ` Philippe Mathieu-Daudé [this message]
2024-04-10  9:13 ` [PULL 12/16] hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 13/16] hw/net/lan9118: Fix overflow in MIL TX FIFO Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 14/16] hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 15/16] hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum() Philippe Mathieu-Daudé
2024-04-10  9:13 ` [PULL 16/16] hw/audio/virtio-snd: Remove unused assignment Philippe Mathieu-Daudé
2024-04-10 15:08 ` [PULL 00/16] Misc HW patches for 2024-04-10 Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240410091315.57241-12-philmd@linaro.org \
    --to=philmd@linaro.org \
    --cc=arei.gonglei@huawei.com \
    --cc=pizhenwei@bytedance.com \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-stable@nongnu.org \
    --cc=zheyuma97@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.