From patchwork Thu Jul 25 20:12:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Stefan Hajnoczi X-Patchwork-Id: 814374 Delivered-To: patch@linaro.org Received: by 2002:adf:e641:0:b0:367:895a:4699 with SMTP id b1csp556387wrn; Thu, 25 Jul 2024 13:13:19 -0700 (PDT) X-Forwarded-Encrypted: i=2; AJvYcCXJ7hGnUn87HhYjwQCedFURxN2VmV8eU4oTrDq5iywS1uzi+wRrlPQiyN8xtVvJZVDVlGRdK1CMoVmDUhm+IdHY X-Google-Smtp-Source: AGHT+IFj8Vr4akxDnqdISk/KP/gunTAiP5nVLEtxeedufuLJZfn7rNfc+YMjHajFpNjX5ZVN6rYy X-Received: by 2002:a05:620a:28cb:b0:79d:58dd:d82b with SMTP id af79cd13be357-7a1d5cbb492mr494067185a.62.1721938399645; Thu, 25 Jul 2024 13:13:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1721938399; cv=none; d=google.com; s=arc-20160816; b=z1JsuOIDXKWt7tiWlntGcb28lU3kziXbGo0LXGw3r7MUGBWG/NibY/TJDHviac88wQ yggYres/ZB1lchT26Qer52TDzmVy9GdzFtW8yDG3eAb4LsL8VRt5dHUZFuheZKYfgWl/ xwXPj4Z6f9izdIZ9WKFI9/G9YJ+Vos/Wna/S7TL0ks1mBeOwavc9KZ6e10eG2lkxEqSD hxt/o1fGn1wBMdP5H3RO8jMOyIr9jz8+jopv6ykJbmeO0j/mXf1RnCIA6OvcKHKWZNNe acY5rnqfo/QVlPepyJvymNU2raKedxSA6Yd8CDfcW53BBawF/fzR/beDlvJ5vnRp30OR HUUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=VVqa5+LoCMu6Kp9TvnjLZk6BG0y9wPquSFjCq1RQVM4=; fh=BA69Et91rpU6MC8TY1AFPUmUmhu8I8VD3F8GvO8HlZ0=; b=x4ZKwZ9eZw4v6XkAZ/jsOQp9I7gdPlrsbQJQZtJO5to7qwSLHngCbaEjyqEyD85h8T QDyYidUimJcNiIMd70RhKJHQ/oM8rkia6keGNheVOwP2MuBgbHh9IHjw8WRBDeXOsNwJ IeN1HMlg2Pqxvfnr4HTZgfU7dpMzpYLr2GCIS4+fIBCNSF5Dt0/jSkOSaRhcLEDxd0eW Hz6uT5DkcDHIj+kdqyb4P4iajscZsixaYfYGfmYqTcJkWoJLLaGyhObRdEJtSiyoEgCI MjAP2qFIB6v7vR1vcYh9CBGJO+tVgBC/s5PSvW1eObQVOzxl7czoL2042oJlITNbZZOi 1nOg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=PO1ubuo4; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id af79cd13be357-7a1d7462383si253530285a.497.2024.07.25.13.13.19 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 25 Jul 2024 13:13:19 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=PO1ubuo4; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX4p7-00072n-S4; Thu, 25 Jul 2024 16:12:26 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX4p5-0006t4-KW for qemu-devel@nongnu.org; Thu, 25 Jul 2024 16:12:23 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX4p4-00068q-4i for qemu-devel@nongnu.org; Thu, 25 Jul 2024 16:12:23 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1721938341; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=VVqa5+LoCMu6Kp9TvnjLZk6BG0y9wPquSFjCq1RQVM4=; b=PO1ubuo4tR1qsQK0pcgFaw+pnqtsrxbhbnupdoFBoq8Aqc3AOufXub2KQUsythKd78xX3q mFgg+oFj2U+Y9D7X+0j1fDFVaxXQK4J8i1c8HcNZFY7+lvQ6Yqy4TdT+nRKWxakHuM05nh gP/c83FfVncCODiZIVkIjkJlzIV+yg8= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-622-WN0vu4GoMsKw4MU5KJY9zA-1; Thu, 25 Jul 2024 16:12:17 -0400 X-MC-Unique: WN0vu4GoMsKw4MU5KJY9zA-1 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E646519560B1; Thu, 25 Jul 2024 20:12:15 +0000 (UTC) Received: from localhost (unknown [10.2.16.100]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id AA7A319560AE; Thu, 25 Jul 2024 20:12:14 +0000 (UTC) From: Stefan Hajnoczi To: qemu-devel@nongnu.org Cc: Hanna Reitz , Stefan Hajnoczi , qemu-block@nongnu.org, Fam Zheng , Kevin Wolf , Richard Henderson , Peter Maydell , =?utf-8?q?Philippe_Mathieu-Daud?= =?utf-8?q?=C3=A9?= Subject: [PULL 1/1] util/async.c: Forbid negative min/max in aio_context_set_thread_pool_params() Date: Thu, 25 Jul 2024 16:12:11 -0400 Message-ID: <20240725201211.460318-2-stefanha@redhat.com> In-Reply-To: <20240725201211.460318-1-stefanha@redhat.com> References: <20240725201211.460318-1-stefanha@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Received-SPF: pass client-ip=170.10.133.124; envelope-from=stefanha@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -21 X-Spam_score: -2.2 X-Spam_bar: -- X-Spam_report: (-2.2 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.144, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Peter Maydell aio_context_set_thread_pool_params() takes two int64_t arguments to set the minimum and maximum number of threads in the pool. We do some bounds checking on these, but we don't catch the case where the inputs are negative. This means that later in the function when we assign these inputs to the AioContext::thread_pool_min and ::thread_pool_max fields, which are of type int, the values might overflow the smaller type. A negative number of threads is meaningless, so make aio_context_set_thread_pool_params() return an error if either min or max are negative. Resolves: Coverity CID 1547605 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-id: 20240723150927.1396456-1-peter.maydell@linaro.org Signed-off-by: Stefan Hajnoczi --- util/async.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util/async.c b/util/async.c index 0467890052..3e3e4fc712 100644 --- a/util/async.c +++ b/util/async.c @@ -746,7 +746,7 @@ void aio_context_set_thread_pool_params(AioContext *ctx, int64_t min, int64_t max, Error **errp) { - if (min > max || !max || min > INT_MAX || max > INT_MAX) { + if (min > max || max <= 0 || min < 0 || min > INT_MAX || max > INT_MAX) { error_setg(errp, "bad thread-pool-min/thread-pool-max values"); return; }