[Qemu-devel] [PATCH] virtio/vhost: do not take address of packed members

Paolo Bonzini posted 1 patch 6 years, 2 months ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/1515755504-21341-2-git-send-email-pbonzini@redhat.com
Test checkpatch passed
Test docker passed
Test ppc passed
Test s390x passed
hw/char/virtio-serial-bus.c | 6 +++---
hw/virtio/vhost-user.c      | 7 +++++--
2 files changed, 8 insertions(+), 5 deletions(-)
[Qemu-devel] [PATCH] virtio/vhost: do not take address of packed members
Posted by Paolo Bonzini 6 years, 2 months ago
The address of a packed member is not packed, which may cause accesses
to unaligned pointers.  Avoid this by reading the packed value before
passing it to another function.

Cc: Jason Wang <jasowang@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/char/virtio-serial-bus.c | 6 +++---
 hw/virtio/vhost-user.c      | 7 +++++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 9470bd7..2d236b3 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -664,9 +664,9 @@ static void virtio_serial_save_device(VirtIODevice *vdev, QEMUFile *f)
 
     /* The config space (ignored on the far end in current versions) */
     get_config(vdev, (uint8_t *)&config);
-    qemu_put_be16s(f, &config.cols);
-    qemu_put_be16s(f, &config.rows);
-    qemu_put_be32s(f, &config.max_nr_ports);
+    qemu_put_be16(f, config.cols);
+    qemu_put_be16(f, config.rows);
+    qemu_put_be32(f, config.max_nr_ports);
 
     /* The ports map */
     max_nr_ports = s->serial.max_virtserial_ports;
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 093675e..3c17207 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -638,8 +638,11 @@ static void slave_read(void *opaque)
 
     switch (msg.request) {
     case VHOST_USER_SLAVE_IOTLB_MSG:
-        ret = vhost_backend_handle_iotlb_msg(dev, &msg.payload.iotlb);
-        break;
+        {
+            struct vhost_iotlb_msg iotlb = msg.payload.iotlb;
+            ret = vhost_backend_handle_iotlb_msg(dev, &iotlb);
+            break;
+        }
     default:
         error_report("Received unexpected msg type.");
         ret = -EINVAL;
-- 
1.8.3.1


Re: [Qemu-devel] [PATCH] virtio/vhost: do not take address of packed members
Posted by Eric Blake 6 years, 2 months ago
On 01/12/2018 05:11 AM, Paolo Bonzini wrote:
> The address of a packed member is not packed, which may cause accesses
> to unaligned pointers.  Avoid this by reading the packed value before
> passing it to another function.
> 
> Cc: Jason Wang <jasowang@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  hw/char/virtio-serial-bus.c | 6 +++---
>  hw/virtio/vhost-user.c      | 7 +++++--
>  2 files changed, 8 insertions(+), 5 deletions(-)
> 

Reviewed-by: Eric Blake <eblake@redhat.com>

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PATCH] virtio/vhost: do not take address of packed members
Posted by Peter Maydell 5 years, 6 months ago
Hi Paolo -- looks like this patch from the beginning of the year got
reviewed by Eric but never actually applied anywhere. Unfortunately
it doesn't apply to master any more -- any chance you could do a rebase
and resend?

(I'm looking idly at all the clang warnings about taking addresses
of fields in packed structures...)

thanks
-- PMM

On 12 January 2018 at 11:11, Paolo Bonzini <pbonzini@redhat.com> wrote:
> The address of a packed member is not packed, which may cause accesses
> to unaligned pointers.  Avoid this by reading the packed value before
> passing it to another function.
>
> Cc: Jason Wang <jasowang@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  hw/char/virtio-serial-bus.c | 6 +++---
>  hw/virtio/vhost-user.c      | 7 +++++--
>  2 files changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
> index 9470bd7..2d236b3 100644
> --- a/hw/char/virtio-serial-bus.c
> +++ b/hw/char/virtio-serial-bus.c
> @@ -664,9 +664,9 @@ static void virtio_serial_save_device(VirtIODevice *vdev, QEMUFile *f)
>
>      /* The config space (ignored on the far end in current versions) */
>      get_config(vdev, (uint8_t *)&config);
> -    qemu_put_be16s(f, &config.cols);
> -    qemu_put_be16s(f, &config.rows);
> -    qemu_put_be32s(f, &config.max_nr_ports);
> +    qemu_put_be16(f, config.cols);
> +    qemu_put_be16(f, config.rows);
> +    qemu_put_be32(f, config.max_nr_ports);
>
>      /* The ports map */
>      max_nr_ports = s->serial.max_virtserial_ports;
> diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
> index 093675e..3c17207 100644
> --- a/hw/virtio/vhost-user.c
> +++ b/hw/virtio/vhost-user.c
> @@ -638,8 +638,11 @@ static void slave_read(void *opaque)
>
>      switch (msg.request) {
>      case VHOST_USER_SLAVE_IOTLB_MSG:
> -        ret = vhost_backend_handle_iotlb_msg(dev, &msg.payload.iotlb);
> -        break;
> +        {
> +            struct vhost_iotlb_msg iotlb = msg.payload.iotlb;
> +            ret = vhost_backend_handle_iotlb_msg(dev, &iotlb);
> +            break;
> +        }
>      default:
>          error_report("Received unexpected msg type.");
>          ret = -EINVAL;
> --
> 1.8.3.1