From patchwork Tue Mar 31 13:21:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Wang X-Patchwork-Id: 185114 Delivered-To: patch@linaro.org Received: by 2002:a92:de47:0:0:0:0:0 with SMTP id e7csp3685792ilr; Tue, 31 Mar 2020 06:27:12 -0700 (PDT) X-Google-Smtp-Source: ADFU+vs2mz1r2SpNMkjn4GqAT8FPr/M1hibPwdmki4FHjttcNyE8GG5VWaeSUK0pjyA9gimbXtp3 X-Received: by 2002:a37:9d89:: with SMTP id g131mr4989289qke.166.1585661232259; Tue, 31 Mar 2020 06:27:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585661232; cv=none; d=google.com; s=arc-20160816; b=kjmm4iyI/4tia3OAx8hhSwB0wLwMAb9d86aftBjttJrT/btAVVXWroh5xWrJcr2HaF ASc45F6CrcJLu7lVu+wZKaaNRPi78uGHyoK30yo6E/pURSbzVGJmjBcQokDEiprvP8zF 8Qw6ygeGivuEIMJyhJl6Wvr6M10zmFUw1VBzH9H086a5lT7HRZpcBbvr9J99JYfVXYou gUodlUvLRetT1gbTCMRmktocoRThQtaAQtcOz0O9Uu8yJo4gNR2V4aa0MyqDQdBborn4 Qeir/1Cf20ls6358BrGU9yvaW7UYCocIOZRlAGfh8hkI5yV68lg0EHXilLl4yJj4sHv4 1r6g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:cc:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :references:in-reply-to:message-id:date:subject:to:from :dkim-signature; bh=tVkaJTRjt24I8sG8iS1Qlco78c4FvepcndOUPlDQIGU=; b=vxSUlWJHya9Y/Z/CTYGnumZmAL4Afh/X3Ezlajy6Eu/U3i1sYRFxrl2YLDjPjmXfiO ztJuUuJAa1yIazWxKi1vOz3OtHmSbfihSFEbrJSFbXtK3TSCrsJHrvzDIA8fwtil4LHO DBlVmuZI5PnVUIw+HwVO429beGToZP4uSSG2UY/LYKj+ctzDhTZE09PmjlMuibnunLIO tDfE62TP+kw/KPKENyle2vEXN7ZWj5XjSCyNKXEGbQ1jPgQN/yBJthNWobNq7V3Aw1x7 XN6hdA2kLhqAjM4nFWoES7ZeyFUFVBE4A+YyRkWW5ig5Wg1QK7AR3dXR4t67+oDFQ/6x i16A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b="VHS98x/e"; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id cf4si9921544qvb.158.2020.03.31.06.27.12 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 31 Mar 2020 06:27:12 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b="VHS98x/e"; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from localhost ([::1]:38020 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jJGv9-0000UT-PC for patch@linaro.org; Tue, 31 Mar 2020 09:27:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:41909) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jJGq7-0000EY-77 for qemu-devel@nongnu.org; Tue, 31 Mar 2020 09:22:01 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1jJGq5-0005fg-Pa for qemu-devel@nongnu.org; Tue, 31 Mar 2020 09:21:59 -0400 Received: from us-smtp-2.mimecast.com ([207.211.31.81]:42836 helo=us-smtp-delivery-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1jJGq5-0005fL-L9 for qemu-devel@nongnu.org; Tue, 31 Mar 2020 09:21:57 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1585660917; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tVkaJTRjt24I8sG8iS1Qlco78c4FvepcndOUPlDQIGU=; b=VHS98x/eEUvqGwtegn7v53a5wdvCWPaAVX0029AjkijQZPrfUM9Mm4+ZG2g9x/r4wGuJc+ DUXthrMG5Z4im4H5xvN/NNG8DFTP8+0F3FuX+tQK18SaYPtXEZD0Vev/vUYoy0m7EW4zdt /UhguZMEy7GXa0xLFn5bBvqAdjkmTXQ= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-41-2rmRCDZePc--G56XQiIJ7Q-1; Tue, 31 Mar 2020 09:21:55 -0400 X-MC-Unique: 2rmRCDZePc--G56XQiIJ7Q-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 7E6531412; Tue, 31 Mar 2020 13:21:54 +0000 (UTC) Received: from jason-ThinkPad-T430s.redhat.com (ovpn-12-118.pek2.redhat.com [10.72.12.118]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1DB9110002BC; Tue, 31 Mar 2020 13:21:52 +0000 (UTC) From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Subject: [PULL V2 02/14] hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive() Date: Tue, 31 Mar 2020 21:21:27 +0800 Message-Id: <1585660899-11228-3-git-send-email-jasowang@redhat.com> In-Reply-To: <1585660899-11228-1-git-send-email-jasowang@redhat.com> References: <1585660899-11228-1-git-send-email-jasowang@redhat.com> X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 207.211.31.81 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jason Wang Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" From: Peter Maydell The i82596_receive() function attempts to pass the guest a buffer which is effectively the concatenation of the data it is passed and a 4 byte CRC value. However, rather than implementing this as "write the data; then write the CRC" it instead bumps the length value of the data by 4, and writes 4 extra bytes from beyond the end of the buffer, which it then overwrites with the CRC. It also assumed that we could always fit all four bytes of the CRC into the final receive buffer, which might not be true if the CRC needs to be split over two receive buffers. Calculate separately how many bytes we need to transfer into the guest's receive buffer from the source buffer, and how many we need to transfer from the CRC work. We add a count 'bufsz' of the number of bytes left in the source buffer, which we use purely to assert() that we don't overrun. Spotted by Coverity (CID 1419396) for the specific case when we end up using a local array as the source buffer. Signed-off-by: Peter Maydell Signed-off-by: Jason Wang --- hw/net/i82596.c | 44 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 35 insertions(+), 9 deletions(-) -- 2.5.0 diff --git a/hw/net/i82596.c b/hw/net/i82596.c index ecdb9aa..3b0efd0 100644 --- a/hw/net/i82596.c +++ b/hw/net/i82596.c @@ -497,7 +497,8 @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz) uint32_t rfd_p; uint32_t rbd; uint16_t is_broadcast = 0; - size_t len = sz; + size_t len = sz; /* length of data for guest (including CRC) */ + size_t bufsz = sz; /* length of data in buf */ uint32_t crc; uint8_t *crc_ptr; uint8_t buf1[MIN_BUF_SIZE + VLAN_HLEN]; @@ -591,6 +592,7 @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz) if (len < MIN_BUF_SIZE) { len = MIN_BUF_SIZE; } + bufsz = len; } /* Calculate the ethernet checksum (4 bytes) */ @@ -623,6 +625,7 @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz) while (len) { uint16_t buffer_size, num; uint32_t rba; + size_t bufcount, crccount; /* printf("Receive: rbd is %08x\n", rbd); */ buffer_size = get_uint16(rbd + 12); @@ -635,14 +638,37 @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz) } rba = get_uint32(rbd + 8); /* printf("rba is 0x%x\n", rba); */ - address_space_write(&address_space_memory, rba, - MEMTXATTRS_UNSPECIFIED, buf, num); - rba += num; - buf += num; - len -= num; - if (len == 0) { /* copy crc */ - address_space_write(&address_space_memory, rba - 4, - MEMTXATTRS_UNSPECIFIED, crc_ptr, 4); + /* + * Calculate how many bytes we want from buf[] and how many + * from the CRC. + */ + if ((len - num) >= 4) { + /* The whole guest buffer, we haven't hit the CRC yet */ + bufcount = num; + } else { + /* All that's left of buf[] */ + bufcount = len - 4; + } + crccount = num - bufcount; + + if (bufcount > 0) { + /* Still some of the actual data buffer to transfer */ + assert(bufsz >= bufcount); + bufsz -= bufcount; + address_space_write(&address_space_memory, rba, + MEMTXATTRS_UNSPECIFIED, buf, bufcount); + rba += bufcount; + buf += bufcount; + len -= bufcount; + } + + /* Write as much of the CRC as fits */ + if (crccount > 0) { + address_space_write(&address_space_memory, rba, + MEMTXATTRS_UNSPECIFIED, crc_ptr, crccount); + rba += crccount; + crc_ptr += crccount; + len -= crccount; } num |= 0x4000; /* set F BIT */ From patchwork Tue Mar 31 13:21:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Wang X-Patchwork-Id: 185115 Delivered-To: patch@linaro.org Received: by 2002:ac9:450d:0:0:0:0:0 with SMTP id n13csp3642268ocg; Tue, 31 Mar 2020 06:34:42 -0700 (PDT) X-Google-Smtp-Source: ADFU+vs3CPyPwtIStg1rswl95j9Tu8Ik/T0gP/qpBpuhLOrnwG5gSE58yZKj9qIHo62RUKQ487vv X-Received: by 2002:a37:888:: with SMTP id 130mr4537762qki.261.1585661682816; Tue, 31 Mar 2020 06:34:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585661682; cv=none; d=google.com; s=arc-20160816; b=ncAtY8kJelSkjuS5iXpYL8sz4LqHY1rubPiAndMh6EFXMKgv2/k9GNolvRvsvbq8oH UaqO86IFdcMuJzLsdBxgh6df8tsqW5CNxQs4eFRZt46zWG3tc5tiIvvcZ0WrcLx0WAz+ oShiKBmf+6D0w7LBmgbKGC7VEiPtXZUknSG5bchzJsQCIcwz878o9Zx8nvFw5jk5yqIm ON+0mt+ApS8n6g6q5LEAkDbTvBVwo4XEOVNJy+h8Rw6mC7Vmw1R3RxyRe/LAIyc/jVOw GtQ+UI41ri11AoxkautYCQmyGGIyelbRhwlr/6QrTCQO1X3HpUDbxxzIaOLESWCClG+C b+3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:cc:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :references:in-reply-to:message-id:date:subject:to:from :dkim-signature; bh=e2MtJXqXrK00L/Pg7ncr4ONHm/ufHOeDphL4A31MD7k=; b=bsv4kUAPw5D0eyvYdBodxrpP3gQUEIpp473hoR126MuojkOlzqaMk9PwV0ymcWyCPh iIUk6mbKjC0LMHm+YjGBH14gKfucOt0+Kjl7rPX4AFhyDoQlC/liTErc/PYxRCIZeObM /H9mwRc/shasbNUAp9Ccs5qlPxxeq06HNG5ujB6NQxXbDKLEXjQn9hO2oQiMBz9H8wnl HgJM+8vhmVJMrMmzjndKXQPA/MSE6v0lS8bqwMioxCTVm6bGTahJRIdq+hMHXXqZbZoL Hjd//bE1zoNdSbH/Ib4ElYgMIninkq0aTqxRy2HD4rU25taApOpzzbVZ3mqbv62jqptA vScQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=XK4II3Km; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id l19si9367436qvy.194.2020.03.31.06.34.42 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 31 Mar 2020 06:34:42 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=XK4II3Km; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from localhost ([::1]:38166 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jJH2Q-0003Af-BB for patch@linaro.org; Tue, 31 Mar 2020 09:34:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:42111) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jJGqZ-0000hD-6Y for qemu-devel@nongnu.org; Tue, 31 Mar 2020 09:22:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1jJGqY-0005yG-47 for qemu-devel@nongnu.org; Tue, 31 Mar 2020 09:22:27 -0400 Received: from us-smtp-delivery-1.mimecast.com ([207.211.31.120]:23412 helo=us-smtp-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1jJGqX-0005xU-WC for qemu-devel@nongnu.org; Tue, 31 Mar 2020 09:22:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1585660945; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=e2MtJXqXrK00L/Pg7ncr4ONHm/ufHOeDphL4A31MD7k=; b=XK4II3KmupQ9QldskIz3TequTmVzdJELICFdFO0eZlP/F98KehM4qA+SBoVrT84VPoJ5o6 LtL8l/JLJOvsja9xUPfRd4zxUgS3tVTeR9MFNyA2JIKuJYiUJ8DC1rajDD8f0ZlVGpg7Qk V7UV4ACuoXbYTCUgqpfeAoY6Sp5HYlg= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-135-8kQxrIl1O6CN6riw5Hu-sg-1; Tue, 31 Mar 2020 09:22:20 -0400 X-MC-Unique: 8kQxrIl1O6CN6riw5Hu-sg-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 3FD45107B267; Tue, 31 Mar 2020 13:22:19 +0000 (UTC) Received: from jason-ThinkPad-T430s.redhat.com (ovpn-12-118.pek2.redhat.com [10.72.12.118]) by smtp.corp.redhat.com (Postfix) with ESMTP id D72801001B28; Tue, 31 Mar 2020 13:22:17 +0000 (UTC) From: Jason Wang To: qemu-devel@nongnu.org, peter.maydell@linaro.org Subject: [PULL V2 13/14] hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads Date: Tue, 31 Mar 2020 21:21:38 +0800 Message-Id: <1585660899-11228-14-git-send-email-jasowang@redhat.com> In-Reply-To: <1585660899-11228-1-git-send-email-jasowang@redhat.com> References: <1585660899-11228-1-git-send-email-jasowang@redhat.com> X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 207.211.31.120 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jason Wang Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" From: Peter Maydell Coverity points out (CID 1421926) that the read code for REG_ADDR_HIGH reads off the end of the buffer, because it does a 32-bit read from byte 4 of a 6-byte buffer. The code also has an endianness issue for both REG_ADDR_HIGH and REG_ADDR_LOW, because it will do the wrong thing on a big-endian host. Rewrite the read code to use ldl_le_p() and lduw_le_p() to fix this; the write code is not incorrect, but for consistency we make it use stl_le_p() and stw_le_p(). Reviewed-by: Richard Henderson Tested-by: Niek Linnenbank Reviewed-by: Niek Linnenbank Signed-off-by: Peter Maydell Signed-off-by: Jason Wang --- hw/net/allwinner-sun8i-emac.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.5.0 diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c index 033eaa8..28637ff 100644 --- a/hw/net/allwinner-sun8i-emac.c +++ b/hw/net/allwinner-sun8i-emac.c @@ -611,10 +611,10 @@ static uint64_t allwinner_sun8i_emac_read(void *opaque, hwaddr offset, value = s->mii_data; break; case REG_ADDR_HIGH: /* MAC Address High */ - value = *(((uint32_t *) (s->conf.macaddr.a)) + 1); + value = lduw_le_p(s->conf.macaddr.a + 4); break; case REG_ADDR_LOW: /* MAC Address Low */ - value = *(uint32_t *) (s->conf.macaddr.a); + value = ldl_le_p(s->conf.macaddr.a); break; case REG_TX_DMA_STA: /* Transmit DMA Status */ break; @@ -728,14 +728,10 @@ static void allwinner_sun8i_emac_write(void *opaque, hwaddr offset, s->mii_data = value; break; case REG_ADDR_HIGH: /* MAC Address High */ - s->conf.macaddr.a[4] = (value & 0xff); - s->conf.macaddr.a[5] = (value & 0xff00) >> 8; + stw_le_p(s->conf.macaddr.a + 4, value); break; case REG_ADDR_LOW: /* MAC Address Low */ - s->conf.macaddr.a[0] = (value & 0xff); - s->conf.macaddr.a[1] = (value & 0xff00) >> 8; - s->conf.macaddr.a[2] = (value & 0xff0000) >> 16; - s->conf.macaddr.a[3] = (value & 0xff000000) >> 24; + stl_le_p(s->conf.macaddr.a, value); break; case REG_TX_DMA_STA: /* Transmit DMA Status */ case REG_TX_CUR_DESC: /* Transmit Current Descriptor */