From nobody Fri May 3 17:22:26 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1490690970102670.3980625822559; Tue, 28 Mar 2017 01:49:30 -0700 (PDT) Received: from localhost ([::1]:51630 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1csmoi-0006b6-RC for importer@patchew.org; Tue, 28 Mar 2017 04:49:28 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37430) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1csmmX-00059U-9m for qemu-devel@nongnu.org; Tue, 28 Mar 2017 04:47:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1csmmU-0005BD-2n for qemu-devel@nongnu.org; Tue, 28 Mar 2017 04:47:13 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:47733) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1csmmT-0005Aj-PW for qemu-devel@nongnu.org; Tue, 28 Mar 2017 04:47:09 -0400 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v2S8hhh5057052 for ; Tue, 28 Mar 2017 04:47:08 -0400 Received: from e06smtp12.uk.ibm.com (e06smtp12.uk.ibm.com [195.75.94.108]) by mx0a-001b2d01.pphosted.com with ESMTP id 29fm1jtbww-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Tue, 28 Mar 2017 04:47:06 -0400 Received: from localhost by e06smtp12.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 28 Mar 2017 09:47:01 +0100 Received: from b06cxnps4076.portsmouth.uk.ibm.com (9.149.109.198) by e06smtp12.uk.ibm.com (192.168.101.142) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 28 Mar 2017 09:46:57 +0100 Received: from d06av26.portsmouth.uk.ibm.com (d06av26.portsmouth.uk.ibm.com [9.149.105.62]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v2S8kvc939518316; Tue, 28 Mar 2017 08:46:57 GMT Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1A646AE058; Tue, 28 Mar 2017 09:46:19 +0100 (BST) Received: from d06av26.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CAD24AE05A; Tue, 28 Mar 2017 09:46:18 +0100 (BST) Received: from smtp.lab.toulouse-stg.fr.ibm.com (unknown [9.101.4.1]) by d06av26.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 28 Mar 2017 09:46:18 +0100 (BST) Received: from bahia.lan (icon-9-164-175-141.megacenter.de.ibm.com [9.164.175.141]) by smtp.lab.toulouse-stg.fr.ibm.com (Postfix) with ESMTP id F211E22010D; Tue, 28 Mar 2017 10:46:52 +0200 (CEST) From: Greg Kurz To: qemu-devel@nongnu.org Date: Tue, 28 Mar 2017 10:46:33 +0200 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1490690794-19023-1-git-send-email-groug@kaod.org> References: <1490690794-19023-1-git-send-email-groug@kaod.org> X-TM-AS-GCONF: 00 x-cbid: 17032808-0008-0000-0000-000004113F28 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17032808-0009-0000-0000-00001D020856 Message-Id: <1490690794-19023-2-git-send-email-groug@kaod.org> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=67 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703280080 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PULL 1/2] 9pfs: fix file descriptor leak X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Li Qiang , Greg Kurz , Li Qiang Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Li Qiang The v9fs_create() and v9fs_lcreate() functions are used to create a file on the backend and to associate it to a fid. The fid shouldn't be already in-use, otherwise both functions may silently leak a file descriptor or allocated memory. The current code doesn't check that. This patch ensures that the fid isn't already associated to anything before using it. Signed-off-by: Li Qiang (reworded the changelog, Greg Kurz) Signed-off-by: Greg Kurz --- hw/9pfs/9p.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index b8c0b993580c..48babce836b6 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -1550,6 +1550,10 @@ static void coroutine_fn v9fs_lcreate(void *opaque) err =3D -ENOENT; goto out_nofid; } + if (fidp->fid_type !=3D P9_FID_NONE) { + err =3D -EINVAL; + goto out; + } =20 flags =3D get_dotl_openflags(pdu->s, flags); err =3D v9fs_co_open2(pdu, fidp, &name, gid, @@ -2153,6 +2157,10 @@ static void coroutine_fn v9fs_create(void *opaque) err =3D -EINVAL; goto out_nofid; } + if (fidp->fid_type !=3D P9_FID_NONE) { + err =3D -EINVAL; + goto out; + } if (perm & P9_STAT_MODE_DIR) { err =3D v9fs_co_mkdir(pdu, fidp, &name, perm & 0777, fidp->uid, -1, &stbuf); --=20 2.7.4 From nobody Fri May 3 17:22:26 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1490690907437534.5937565542301; Tue, 28 Mar 2017 01:48:27 -0700 (PDT) Received: from localhost ([::1]:51627 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1csmni-0005rX-Cd for importer@patchew.org; Tue, 28 Mar 2017 04:48:26 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37417) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1csmmV-00058P-E8 for qemu-devel@nongnu.org; Tue, 28 Mar 2017 04:47:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1csmmS-0005AL-CR for qemu-devel@nongnu.org; Tue, 28 Mar 2017 04:47:11 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:47645) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1csmmS-00059s-2v for qemu-devel@nongnu.org; Tue, 28 Mar 2017 04:47:08 -0400 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v2S8kbdA069291 for ; Tue, 28 Mar 2017 04:47:07 -0400 Received: from e06smtp12.uk.ibm.com (e06smtp12.uk.ibm.com [195.75.94.108]) by mx0a-001b2d01.pphosted.com with ESMTP id 29fm1jtc12-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Tue, 28 Mar 2017 04:47:06 -0400 Received: from localhost by e06smtp12.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 28 Mar 2017 09:47:04 +0100 Received: from b06cxnps4076.portsmouth.uk.ibm.com (9.149.109.198) by e06smtp12.uk.ibm.com (192.168.101.142) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 28 Mar 2017 09:47:00 +0100 Received: from d06av24.portsmouth.uk.ibm.com (mk.ibm.com [9.149.105.60]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v2S8l0Tw40173698; Tue, 28 Mar 2017 08:47:00 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3D4D74204F; Tue, 28 Mar 2017 09:46:23 +0100 (BST) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2A7AD42047; Tue, 28 Mar 2017 09:46:23 +0100 (BST) Received: from smtp.lab.toulouse-stg.fr.ibm.com (unknown [9.101.4.1]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 28 Mar 2017 09:46:23 +0100 (BST) Received: from bahia.lan (icon-9-164-175-141.megacenter.de.ibm.com [9.164.175.141]) by smtp.lab.toulouse-stg.fr.ibm.com (Postfix) with ESMTP id 35A3E22010D; Tue, 28 Mar 2017 10:46:57 +0200 (CEST) From: Greg Kurz To: qemu-devel@nongnu.org Date: Tue, 28 Mar 2017 10:46:34 +0200 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1490690794-19023-1-git-send-email-groug@kaod.org> References: <1490690794-19023-1-git-send-email-groug@kaod.org> X-TM-AS-GCONF: 00 x-cbid: 17032808-0008-0000-0000-000004113F2E X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17032808-0009-0000-0000-00001D020868 Message-Id: <1490690794-19023-3-git-send-email-groug@kaod.org> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=4 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703280080 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PULL 2/2] tests/virtio-9p-test: Don't call le*_to_cpus on fields of packed struct X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Greg Kurz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Peter Maydell For a packed struct like 'P9Hdr' the fields within it may not be aligned as much as the natural alignment for their types. This means it is not valid to pass the address of such a field to a function like le32_to_cpus() which operate on uint32_t* and assume alignment. Doing this results in a SIGBUS on hosts like SPARC which have strict alignment requirements. Use ldl_le_p() instead, which is specified to correctly handle unaligned pointers. Signed-off-by: Peter Maydell Reviewed-by: Greg Kurz Signed-off-by: Greg Kurz --- tests/virtio-9p-test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/virtio-9p-test.c b/tests/virtio-9p-test.c index 43a1ad813fda..ad33d963876f 100644 --- a/tests/virtio-9p-test.c +++ b/tests/virtio-9p-test.c @@ -256,8 +256,8 @@ static void v9fs_req_recv(P9Req *req, uint8_t id) qvirtio_wait_queue_isr(v9p->dev, v9p->vq, 1000 * 1000); =20 v9fs_memread(req, &hdr, 7); - le32_to_cpus(&hdr.size); - le16_to_cpus(&hdr.tag); + hdr.size =3D ldl_le_p(&hdr.size); + hdr.tag =3D lduw_le_p(&hdr.tag); if (hdr.size >=3D 7) { break; } --=20 2.7.4