From nobody Thu May 16 15:32:28 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=red-soft.ru Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1713256072498693.1376963254501; Tue, 16 Apr 2024 01:27:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rwe9O-0005WE-BA; Tue, 16 Apr 2024 04:26:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rwe9K-0005VZ-UJ; Tue, 16 Apr 2024 04:26:42 -0400 Received: from red-soft.ru ([188.246.186.2] helo=gw.red-soft.ru) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rwe9I-0007OQ-3Q; Tue, 16 Apr 2024 04:26:42 -0400 Received: from localhost.biz (unknown [10.81.100.48]) by gw.red-soft.ru (Postfix) with ESMTPA id 483E33E1CE7; Tue, 16 Apr 2024 11:26:34 +0300 (MSK) From: Artem Chernyshev To: Nicholas Piggin Cc: Artem Chernyshev , Daniel Henrique Barboza , David Gibson , Harsh Prateek Bora , qemu-ppc@nongnu.org, qemu-devel@nongnu.org, Oleg Sviridov Subject: [PATCH] hw/nvram: Make (len + offset) check more strict Date: Tue, 16 Apr 2024 11:26:31 +0300 Message-Id: <20240416082631.2417370-1-artem.chernyshev@red-soft.ru> X-Mailer: git-send-email 2.37.3 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-KLMS-Rule-ID: 1 X-KLMS-Message-Action: clean X-KLMS-AntiSpam-Lua-Profiles: 184729 [Apr 16 2024] X-KLMS-AntiSpam-Version: 6.1.0.4 X-KLMS-AntiSpam-Envelope-From: artem.chernyshev@red-soft.ru X-KLMS-AntiSpam-Rate: 0 X-KLMS-AntiSpam-Status: not_detected X-KLMS-AntiSpam-Method: none X-KLMS-AntiSpam-Auth: dkim=none X-KLMS-AntiSpam-Info: LuaCore: 17 0.3.17 f2153f38d75b12894d9cf445f96cd15c9ef63a9d, {Tracking_from_domain_doesnt_match_to}, localhost.biz:7.1.1; red-soft.ru:7.1.1; d41d8cd98f00b204e9800998ecf8427e.com:7.1.1; 127.0.0.199:7.1.2, FromAlignment: s X-MS-Exchange-Organization-SCL: -1 X-KLMS-AntiSpam-Interceptor-Info: scan successful X-KLMS-AntiPhishing: Clean, bases: 2024/04/16 06:38:00 X-KLMS-AntiVirus: Kaspersky Security for Linux Mail Server, version 8.0.3.30, bases: 2024/04/16 06:04:00 #24816272 X-KLMS-AntiVirus-Status: Clean, skipped Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=188.246.186.2; envelope-from=artem.chernyshev@red-soft.ru; helo=gw.red-soft.ru X-Spam_score_int: -5 X-Spam_score: -0.6 X-Spam_bar: / X-Spam_report: (-0.6 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_VALIDITY_RPBL=1.31, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1713256075374100003 Content-Type: text/plain; charset="utf-8" In rtas_nvram_fetch() and rtas_nvram_store() if len is equal to zero, result of a cpu_physical_memory_map() will be NULL.=20 It will lead to NULL dereference, since return value using=20 without check. It could be avoided by making IF condition=20 more strict. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Oleg Sviridov Signed-off-by: Artem Chernyshev --- hw/nvram/spapr_nvram.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/nvram/spapr_nvram.c b/hw/nvram/spapr_nvram.c index bfd8aa367e..bf0a7d05df 100644 --- a/hw/nvram/spapr_nvram.c +++ b/hw/nvram/spapr_nvram.c @@ -79,7 +79,7 @@ static void rtas_nvram_fetch(PowerPCCPU *cpu, SpaprMachin= eState *spapr, buffer =3D rtas_ld(args, 1); len =3D rtas_ld(args, 2); =20 - if (((offset + len) < offset) + if (((offset + len) <=3D offset) || ((offset + len) > nvram->size)) { rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR); rtas_st(rets, 1, 0); @@ -120,7 +120,7 @@ static void rtas_nvram_store(PowerPCCPU *cpu, SpaprMach= ineState *spapr, buffer =3D rtas_ld(args, 1); len =3D rtas_ld(args, 2); =20 - if (((offset + len) < offset) + if (((offset + len) <=3D offset) || ((offset + len) > nvram->size)) { rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR); return; --=20 2.37.3