From nobody Fri May 3 20:45:42 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1510912678326167.30017354117012; Fri, 17 Nov 2017 01:57:58 -0800 (PST) Received: from localhost ([::1]:44801 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eFdP6-00043y-0w for importer@patchew.org; Fri, 17 Nov 2017 04:57:44 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40384) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eFdO7-0003gp-BM for qemu-devel@nongnu.org; Fri, 17 Nov 2017 04:56:44 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eFdO3-0003Op-51 for qemu-devel@nongnu.org; Fri, 17 Nov 2017 04:56:43 -0500 Received: from mx1.redhat.com ([209.132.183.28]:40166) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eFdO2-0003O0-VF for qemu-devel@nongnu.org; Fri, 17 Nov 2017 04:56:39 -0500 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id BD5FD80473; Fri, 17 Nov 2017 09:56:37 +0000 (UTC) Received: from sirius.home.kraxel.org (ovpn-116-103.ams2.redhat.com [10.36.116.103]) by smtp.corp.redhat.com (Postfix) with ESMTP id EC47C5C54E; Fri, 17 Nov 2017 09:56:34 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 31D57A202; Fri, 17 Nov 2017 10:56:34 +0100 (CET) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Fri, 17 Nov 2017 10:56:34 +0100 Message-Id: <20171117095634.13947-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Fri, 17 Nov 2017 09:56:37 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH] ps2: simplify ps2_common_post_load() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Gerd Hoffmann , Prasad J Pandit Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" It's broken right now, due to q->data and tmp_data data types not being the same. So, with that being unnoticed for years I guess the queue backward compatibility handling (for old qemu versions with a larger queue) can't be that important. So, in case we find any queue data we can't accept just drop the events. That also catches some cases we didn't notice before and avoids oob access due to invalid migration streams. Remove the (broken) code which moved around the queue elements. Cc: Paolo Bonzini Cc: Prasad J Pandit Reported-by: Cyrille Chatras Signed-off-by: Gerd Hoffmann --- hw/input/ps2.c | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-) diff --git a/hw/input/ps2.c b/hw/input/ps2.c index f388a23c8e..dfc3956bad 100644 --- a/hw/input/ps2.c +++ b/hw/input/ps2.c @@ -1225,28 +1225,17 @@ static void ps2_common_reset(PS2State *s) static void ps2_common_post_load(PS2State *s) { PS2Queue *q =3D &s->queue; - int size; - int i; - int tmp_data[PS2_QUEUE_SIZE]; =20 - /* set the useful data buffer queue size, < PS2_QUEUE_SIZE */ - size =3D q->count > PS2_QUEUE_SIZE ? 0 : q->count; - - /* move the queue elements to the start of data array */ - if (size > 0) { - for (i =3D 0; i < size; i++) { - /* move the queue elements to the temporary buffer */ - tmp_data[i] =3D q->data[q->rptr]; - if (++q->rptr =3D=3D 256) { - q->rptr =3D 0; - } - } - memcpy(q->data, tmp_data, size); + if (q->count < 0 || q->count > PS2_QUEUE_SIZE || + q->rptr < 0 || q->rptr >=3D PS2_QUEUE_SIZE || + q->wptr < 0 || q->wptr >=3D PS2_QUEUE_SIZE) { + /* sanity check failed -> drop input events */ + ps2_reset_queue(s); + return; } - /* reset rptr/wptr/count */ - q->rptr =3D 0; - q->wptr =3D size; - q->count =3D size; + + /* wptr is redundant. Set it for consistency reasons. */ + q->wptr =3D (q->rptr + q->count) % PS2_QUEUE_SIZE; s->update_irq(s->update_arg, q->count !=3D 0); } =20 --=20 2.9.3