From nobody Sun Feb 8 11:21:41 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=oracle.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1535739568181503.0677630589105; Fri, 31 Aug 2018 11:19:28 -0700 (PDT) Received: from localhost ([::1]:56118 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvo11-0005O1-3G for importer@patchew.org; Fri, 31 Aug 2018 14:19:27 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50028) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvnwE-0007Co-KS for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fvnwC-0005tO-05 for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:30 -0400 Received: from aserp2120.oracle.com ([141.146.126.78]:55864) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fvnwB-0005t7-Pt for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:27 -0400 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7VIDtgA094208 for ; Fri, 31 Aug 2018 18:14:27 GMT Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp2120.oracle.com with ESMTP id 2m2y2q4vj8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:26 +0000 Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIEPot021138 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:26 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIEPeT023688 for ; Fri, 31 Aug 2018 18:14:25 GMT Received: from ol7.nl.oracle.com (/10.175.61.138) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 31 Aug 2018 11:14:25 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id : in-reply-to : references; s=corp-2018-07-02; bh=eDhTNATvwz0R/eran1+RhIzM6VNSevCzSAtvdr4AQ90=; b=eVqlXNHg3ooTodi9OwuV9gXa8EK1J1SYC3Y/QU3OBYTfEeRi+Qv60prbK7QN6IPbFoif 48tjDDehCDRg309JDSxNESbcJP2wkomn5tBQ2nWmldSDsBFbB5cRBb8JcVzccnYNR66m gE1OYGr8LfBors6wKstpls9KKHxoGFkfUbFzhA18uWQIxDfOQDGQGupQj7iUftx89c7Q C+6eYvAuOL/A19003R5kKwnTcBHqzqcDhrbJ8AzKmDaze2lDkV0TDYcWByQs7Wp4IKkB TNnBNaNom3hERI0lRgGKmkAM7tC38/CNoFcIsOYcC6425PXi5pAH9Pc+CbKh9O76qHpP lg== From: Liam Merwick To: qemu-devel@nongnu.org Date: Fri, 31 Aug 2018 19:16:05 +0100 Message-Id: <1535739372-24454-2-git-send-email-Liam.Merwick@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> References: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=9001 signatures=668708 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=734 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808310183 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 141.146.126.78 Subject: [Qemu-devel] [PATCH v3 1/8] configure: Provide option to explicitly disable AVX2 X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDMRC_1 RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The configure script detects if the compiler has AVX2 support and automatically sets avx2_opt=3D"yes" which in turn defines CONFIG_AVX2_OPT. There is no way of explicitly overriding this setting so this commit adds two command-line options: --enable-avx2 and --disable-avx2. The default behaviour, when no option is specified, is to maintain the current behaviour and enable AVX2 if the compiler supports it. Signed-off-by: Liam Merwick Reviewed-by: Darren Kenny Reviewed-by: Mark Kanda --- configure | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/configure b/configure index 58862d2ae88a..8904a91715b3 100755 --- a/configure +++ b/configure @@ -427,7 +427,7 @@ usb_redir=3D"" opengl=3D"" opengl_dmabuf=3D"no" cpuid_h=3D"no" -avx2_opt=3D"no" +avx2_opt=3D"" zlib=3D"yes" capstone=3D"" lzo=3D"" @@ -1332,6 +1332,10 @@ for opt do ;; --disable-glusterfs) glusterfs=3D"no" ;; + --disable-avx2) avx2_opt=3D"no" + ;; + --enable-avx2) avx2_opt=3D"yes" + ;; --enable-glusterfs) glusterfs=3D"yes" ;; --disable-virtio-blk-data-plane|--enable-virtio-blk-data-plane) @@ -1709,6 +1713,7 @@ disabled with --disable-FEATURE, default is enabled i= f available: libxml2 for Parallels image format tcmalloc tcmalloc support jemalloc jemalloc support + avx2 AVX2 optimization support replication replication support vhost-vsock virtio sockets device support opengl opengl support @@ -5127,7 +5132,7 @@ fi # There is no point enabling this if cpuid.h is not usable, # since we won't be able to select the new routines. =20 -if test $cpuid_h =3D yes; then +if test "$cpuid_h" =3D "yes" -a "$avx2_opt" !=3D "no"; then cat > $TMPC << EOF #pragma GCC push_options #pragma GCC target("avx2") @@ -5141,6 +5146,8 @@ int main(int argc, char *argv[]) { return bar(argv[0]= ); } EOF if compile_object "" ; then avx2_opt=3D"yes" + else + avx2_opt=3D"no" fi fi =20 --=20 1.8.3.1 From nobody Sun Feb 8 11:21:41 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=oracle.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1535739413639686.873519059866; Fri, 31 Aug 2018 11:16:53 -0700 (PDT) Received: from localhost ([::1]:56109 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvnyV-0000hc-IG for importer@patchew.org; Fri, 31 Aug 2018 14:16:52 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50033) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvnwF-0007D9-31 for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fvnwC-0005tW-CM for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:31 -0400 Received: from aserp2120.oracle.com ([141.146.126.78]:55868) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fvnwC-0005tI-5V for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:28 -0400 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7VIDtnr094209 for ; Fri, 31 Aug 2018 18:14:27 GMT Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp2120.oracle.com with ESMTP id 2m2y2q4vja-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:27 +0000 Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIEQEQ019445 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:27 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w7VIEQtN029535 for ; Fri, 31 Aug 2018 18:14:26 GMT Received: from ol7.nl.oracle.com (/10.175.61.138) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 31 Aug 2018 11:14:26 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id : in-reply-to : references; s=corp-2018-07-02; bh=8w2AxTHB+fHC+0PWWlPdQYopf7Bh5uZTSazLvQYYUMw=; b=xh0r8sCya0Qhg4VMXd6nRa9mSssdCH0ODCrSUNvr0GANL4pHMXvcLccVvQDNjYYkaHcU pyyhPkeXbJaZmIKSzSpn9SqZtcyB713EYDIL/gsCqRpLkHFh8db29QaMHPHZocI2O9S5 7iQ2ss0IrcsmFcoDGft1t46fhbfBNgE1ITvGSKZkco4Zhp8vD/sc0lOGkI74TbsU0oUC f0gvS180aaDh200O5ZPmQCyCC4rN+N8Krbf63Imuh/Wncditox2ZAR6yWwrMgIaold9q 7jVm8zDzMteHbVJkJeLwvwHPjTyF1PD/e4I3PGUx1U2Wdd0DL8122gm5twgqffBVV1wo TA== From: Liam Merwick To: qemu-devel@nongnu.org Date: Fri, 31 Aug 2018 19:16:06 +0100 Message-Id: <1535739372-24454-3-git-send-email-Liam.Merwick@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> References: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=9001 signatures=668708 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=854 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808310183 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 141.146.126.78 Subject: [Qemu-devel] [PATCH v3 2/8] job: Fix off-by-one assert checks for JobSTT and JobVerbTable X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDMRC_1 RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" In the assert checking the array dereference of JobVerbTable[verb] in job_apply_verb() the check of the index, verb, allows an overrun because an index equal to the array size is permitted. Similarly, in the assert check of JobSTT[s0][s1] with index s1 in job_state_transition(), an off-by-one overrun is not flagged either. This is not a run-time issue as there are no callers actually passing in the max value. Signed-off-by: Liam Merwick Reviewed-by: Darren Kenny Reviewed-by: Mark Kanda Reviewed-by: Eric Blake Reviewed-by: John Snow --- job.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/job.c b/job.c index e36ebaafd81c..40320566f43b 100644 --- a/job.c +++ b/job.c @@ -166,7 +166,7 @@ bool job_is_internal(Job *job) static void job_state_transition(Job *job, JobStatus s1) { JobStatus s0 =3D job->status; - assert(s1 >=3D 0 && s1 <=3D JOB_STATUS__MAX); + assert(s1 >=3D 0 && s1 < JOB_STATUS__MAX); trace_job_state_transition(job, job->ret, JobSTT[s0][s1] ? "allowed" : "disallowed", JobStatus_str(s0), JobStatus_str(s1)); @@ -181,7 +181,7 @@ static void job_state_transition(Job *job, JobStatus s1) int job_apply_verb(Job *job, JobVerb verb, Error **errp) { JobStatus s0 =3D job->status; - assert(verb >=3D 0 && verb <=3D JOB_VERB__MAX); + assert(verb >=3D 0 && verb < JOB_VERB__MAX); trace_job_apply_verb(job, JobStatus_str(s0), JobVerb_str(verb), JobVerbTable[verb][s0] ? "allowed" : "prohibited"= ); if (JobVerbTable[verb][s0]) { --=20 1.8.3.1 From nobody Sun Feb 8 11:21:41 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=oracle.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1535739412126309.40382753556355; Fri, 31 Aug 2018 11:16:52 -0700 (PDT) Received: from localhost ([::1]:56108 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvnyR-0000ZH-Oi for importer@patchew.org; Fri, 31 Aug 2018 14:16:47 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50034) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvnwF-0007DB-37 for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fvnwD-0005tw-DL for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:31 -0400 Received: from aserp2120.oracle.com ([141.146.126.78]:55882) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fvnwD-0005td-6H for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:29 -0400 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7VIDm0E094147 for ; Fri, 31 Aug 2018 18:14:28 GMT Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp2120.oracle.com with ESMTP id 2m2y2q4vjc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:28 +0000 Received: from userv0122.oracle.com (userv0122.oracle.com [156.151.31.75]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIERKV019478 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:28 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by userv0122.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIEReO021051 for ; Fri, 31 Aug 2018 18:14:27 GMT Received: from ol7.nl.oracle.com (/10.175.61.138) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 31 Aug 2018 11:14:27 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id : in-reply-to : references; s=corp-2018-07-02; bh=p/3GpT6mCmpta1WDgi6uy9ouAWsAbVPq/7JoVAsXPOs=; b=h6Euy+Pxbc2SOotBSZtg52aRYcWbjbNRVV7jpTWgYQCP1vuvbibasZ8MJJeXMZ9n7gG6 qWGnZprWm7Kdmh5YKgOXqqP8WiWx70IM2YvdXKepv0QC3WsBs5RarT9GJzVk+zHlrdxr 5NcFWK9grerfSAExvlbcI+T2rDV+5wGmh5x6zCDZKwWMfcwYK8fG1vRpxQ2GjSWJcCkF oauIPBUllaXreb852TbTSUlKJV1Lxsxa+PrXXk7r/Wtmf4IWDr0Npjbk5H7bqolqfYAC qI0D7OLHeIi0fwa7lLe2aq6AXZcq85JurKII0F3vsb1G7DJEYxjNhPT16L0YmOX5Lb8l vQ== From: Liam Merwick To: qemu-devel@nongnu.org Date: Fri, 31 Aug 2018 19:16:07 +0100 Message-Id: <1535739372-24454-4-git-send-email-Liam.Merwick@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> References: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=9001 signatures=668708 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=930 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808310183 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 141.146.126.78 Subject: [Qemu-devel] [PATCH v3 3/8] block: Null pointer dereference in blk_root_get_parent_desc() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDMRC_1 RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The dev_id returned by the call to blk_get_attached_dev_id() in blk_root_get_parent_desc() can be NULL (an internal call to object_get_canonical_path may have returned NULL) so it should be checked before dereferencing. Signed-off-by: Liam Merwick Reviewed-by: Darren Kenny Reviewed-by: Mark Kanda --- block/block-backend.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/block-backend.c b/block/block-backend.c index fa120630be83..210eee75006a 100644 --- a/block/block-backend.c +++ b/block/block-backend.c @@ -136,7 +136,7 @@ static char *blk_root_get_parent_desc(BdrvChild *child) } =20 dev_id =3D blk_get_attached_dev_id(blk); - if (*dev_id) { + if (dev_id && *dev_id) { return dev_id; } else { /* TODO Callback into the BB owner for something more detailed */ --=20 1.8.3.1 From nobody Sun Feb 8 11:21:41 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=oracle.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1535739591326358.5701916859823; Fri, 31 Aug 2018 11:19:51 -0700 (PDT) Received: from localhost ([::1]:56119 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvo1O-0005dZ-7R for importer@patchew.org; Fri, 31 Aug 2018 14:19:50 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50065) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvnwG-0007EM-Lu for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:33 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fvnwD-0005uF-W8 for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:32 -0400 Received: from aserp2120.oracle.com ([141.146.126.78]:55890) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fvnwD-0005tn-NO for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:29 -0400 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7VIDih4094124 for ; Fri, 31 Aug 2018 18:14:28 GMT Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp2120.oracle.com with ESMTP id 2m2y2q4vjd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:28 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIESd4019484 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:28 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w7VIESLU007759 for ; Fri, 31 Aug 2018 18:14:28 GMT Received: from ol7.nl.oracle.com (/10.175.61.138) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 31 Aug 2018 11:14:28 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id : in-reply-to : references; s=corp-2018-07-02; bh=d57m5px3UpkBjMYNbdfrJ5lORtZvHO6efeRyL6punSc=; b=RbO7SkjADPxuJYxcqahzDCEg0wdaGNY8SF+Z9lF0EanQnOPsjpja0MZ96nZXZ04gpgQz 4J/+TOLyO9hfOHJD1XZlxC/7Ip1fR650wdRWpqkg0lGRuCnzCOHpEpGTI7N1QwC9geg/ VJVEyyvVw2xKAj9jYG1YJW7m3y7n/6GiXrFFfDVEcaAgy67EQLCAqAzopBqt9ltsWwM1 agdgFRSsJjWKowUy8n+aVxGp7rBp0EwOswUnRSugkt4DJL7uYDn1Hi6ttTej+FlnSOd+ ew5zzTvdVUKjSy2mHNx2aYVBJiimuKpJND39wL90Popsj9ReHbVCpMWpzWDcCTn+PVCP bg== From: Liam Merwick To: qemu-devel@nongnu.org Date: Fri, 31 Aug 2018 19:16:08 +0100 Message-Id: <1535739372-24454-5-git-send-email-Liam.Merwick@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> References: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=9001 signatures=668708 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=794 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808310183 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 141.146.126.78 Subject: [Qemu-devel] [PATCH v3 4/8] qemu-img: potential Null pointer deref in img_commit() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDMRC_1 RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The function block_job_get() may return NULL so before dereferencing the 'job' pointer in img_commit() it should be checked. Signed-off-by: Liam Merwick Reviewed-by: Darren Kenny Reviewed-by: Mark Kanda Reviewed-by: John Snow --- qemu-img.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/qemu-img.c b/qemu-img.c index b12f4cd19b0a..51fe09bd08ed 100644 --- a/qemu-img.c +++ b/qemu-img.c @@ -1029,6 +1029,9 @@ static int img_commit(int argc, char **argv) } =20 job =3D block_job_get("commit"); + if (job =3D=3D NULL) { + goto unref_backing; + } run_block_job(job, &local_err); if (local_err) { goto unref_backing; --=20 1.8.3.1 From nobody Sun Feb 8 11:21:41 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=oracle.com Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 1535739736715395.672304956163; Fri, 31 Aug 2018 11:22:16 -0700 (PDT) Received: from localhost ([::1]:56133 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvo3Y-0007EA-Hl for importer@patchew.org; Fri, 31 Aug 2018 14:22:04 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50068) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvnwG-0007Eb-Sl for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:34 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fvnwF-0005uz-CB for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:32 -0400 Received: from userp2130.oracle.com ([156.151.31.86]:50532) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fvnwF-0005uR-3a for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:31 -0400 Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7VIDgLO061916 for ; Fri, 31 Aug 2018 18:14:30 GMT Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp2130.oracle.com with ESMTP id 2m2xhucv7f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:30 +0000 Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIETPL019507 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:29 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIETlw023698 for ; Fri, 31 Aug 2018 18:14:29 GMT Received: from ol7.nl.oracle.com (/10.175.61.138) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 31 Aug 2018 11:14:28 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id : in-reply-to : references; s=corp-2018-07-02; bh=y/iXqS2mgXQufQSoaTle9V2E2l5V2Czhnww5kswlI9A=; b=4QmpbWRJ385ZMeCkMnFjEbPKBi96PXlYdybBfoJDtnkuabgvUuMkxXExxrwyzQevykm1 Fp7DCORdPvWfaT1anFbxlLvHeA8zd5u1HtnlJ1QzZKX1cxGfL7TY5Iw8SfJ2JA+LrgW6 h1PuIUYcAOeyyISDbmkbPCxtVtwqr4d4jNltCpXVwmlRQAUrqcouI8tzqohEYmqpXQt6 Z/v6ax04PStZ4pUZf7o0L+wJD9Ik/RW5PldI2y9/8/iGdWddaVkNw08kIPvBZyADUcGG lfd2i2Y+3nd7YT1BNtv+PyAQNj5jqEXLxKY+amqYQaukdX8hbqRbW3VKreDeQoNL1+8L mA== From: Liam Merwick To: qemu-devel@nongnu.org Date: Fri, 31 Aug 2018 19:16:09 +0100 Message-Id: <1535739372-24454-6-git-send-email-Liam.Merwick@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> References: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=9001 signatures=668708 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=4 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=749 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808310183 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 156.151.31.86 Subject: [Qemu-devel] [PATCH v3 5/8] block: Fix potential Null pointer dereferences in vvfat.c X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDMRC_1 RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The calls to bdrv_new_open_driver(), find_mapping_for_cluster(), and array_get_next() may return NULL but it isn't always checked for before dereferencing the value returned. Signed-off-by: Liam Merwick Reviewed-by: Darren Kenny Reviewed-by: Mark Kanda --- block/vvfat.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/block/vvfat.c b/block/vvfat.c index fc41841a5c3c..0f1f10a2f94b 100644 --- a/block/vvfat.c +++ b/block/vvfat.c @@ -448,6 +448,9 @@ static direntry_t *create_long_filename(BDRVVVFATState = *s, const char *filename) =20 for(i=3D0;idirectory)); + if (entry =3D=3D NULL) { + continue; + } entry->attributes=3D0xf; entry->reserved[0]=3D0; entry->begin=3D0; @@ -665,6 +668,9 @@ static inline void fat_set(BDRVVVFATState* s,unsigned i= nt cluster,uint32_t value } else { int offset =3D (cluster*3/2); unsigned char* p =3D array_get(&(s->fat), offset); + if (p =3D=3D NULL) { + return; + } switch (cluster&1) { case 0: p[0] =3D value&0xff; @@ -730,6 +736,9 @@ static inline direntry_t* create_short_and_long_name(BD= RVVVFATState* s, =20 if(is_dot) { entry=3Darray_get_next(&(s->directory)); + if (entry =3D=3D NULL) { + return NULL; + } memset(entry->name, 0x20, sizeof(entry->name)); memcpy(entry->name,filename,strlen(filename)); return entry; @@ -844,6 +853,12 @@ static int read_directory(BDRVVVFATState* s, int mappi= ng_index) /* create mapping for this file */ if(!is_dot && !is_dotdot && (S_ISDIR(st.st_mode) || st.st_size)) { s->current_mapping =3D array_get_next(&(s->mapping)); + if (s->current_mapping =3D=3D NULL) { + fprintf(stderr, "Failed to create mapping for file\n"); + g_free(buffer); + closedir(dir); + return -2; + } s->current_mapping->begin=3D0; s->current_mapping->end=3Dst.st_size; /* @@ -941,6 +956,9 @@ static int init_directories(BDRVVVFATState* s, /* add volume label */ { direntry_t* entry=3Darray_get_next(&(s->directory)); + if (entry =3D=3D NULL) { + return -1; + } entry->attributes=3D0x28; /* archive | volume label */ memcpy(entry->name, s->volume_label, sizeof(entry->name)); } @@ -953,6 +971,9 @@ static int init_directories(BDRVVVFATState* s, s->cluster_count=3Dsector2cluster(s, s->sector_count); =20 mapping =3D array_get_next(&(s->mapping)); + if (mapping =3D=3D NULL) { + return -1; + } mapping->begin =3D 0; mapping->dir_index =3D 0; mapping->info.dir.parent_mapping_index =3D -1; @@ -1630,6 +1651,9 @@ static void schedule_rename(BDRVVVFATState* s, uint32_t cluster, char* new_path) { commit_t* commit =3D array_get_next(&(s->commits)); + if (commit =3D=3D NULL) { + return; + } commit->path =3D new_path; commit->param.rename.cluster =3D cluster; commit->action =3D ACTION_RENAME; @@ -1639,6 +1663,9 @@ static void schedule_writeout(BDRVVVFATState* s, int dir_index, uint32_t modified_offset) { commit_t* commit =3D array_get_next(&(s->commits)); + if (commit =3D=3D NULL) { + return; + } commit->path =3D NULL; commit->param.writeout.dir_index =3D dir_index; commit->param.writeout.modified_offset =3D modified_offset; @@ -1649,6 +1676,9 @@ static void schedule_new_file(BDRVVVFATState* s, char* path, uint32_t first_cluster) { commit_t* commit =3D array_get_next(&(s->commits)); + if (commit =3D=3D NULL) { + return; + } commit->path =3D path; commit->param.new_file.first_cluster =3D first_cluster; commit->action =3D ACTION_NEW_FILE; @@ -1657,6 +1687,9 @@ static void schedule_new_file(BDRVVVFATState* s, static void schedule_mkdir(BDRVVVFATState* s, uint32_t cluster, char* path) { commit_t* commit =3D array_get_next(&(s->commits)); + if (commit =3D=3D NULL) { + return; + } commit->path =3D path; commit->param.mkdir.cluster =3D cluster; commit->action =3D ACTION_MKDIR; @@ -2261,6 +2294,9 @@ static mapping_t* insert_mapping(BDRVVVFATState* s, } if (index >=3D s->mapping.next || mapping->begin > begin) { mapping =3D array_insert(&(s->mapping), index, 1); + if (mapping =3D=3D NULL) { + return NULL; + } mapping->path =3D NULL; adjust_mapping_indices(s, index, +1); } @@ -2428,6 +2464,9 @@ static int commit_direntries(BDRVVVFATState* s, direntry_t* direntry =3D array_get(&(s->directory), dir_index); uint32_t first_cluster =3D dir_index =3D=3D 0 ? 0 : begin_of_direntry(= direntry); mapping_t* mapping =3D find_mapping_for_cluster(s, first_cluster); + if (mapping =3D=3D NULL) { + return -1; + } =20 int factor =3D 0x10 * s->sectors_per_cluster; int old_cluster_count, new_cluster_count; @@ -2494,6 +2533,9 @@ DLOG(fprintf(stderr, "commit_direntries for %s, paren= t_mapping_index %d\n", mapp direntry =3D array_get(&(s->directory), first_dir_index + i); if (is_directory(direntry) && !is_dot(direntry)) { mapping =3D find_mapping_for_cluster(s, first_cluster); + if (mapping =3D=3D NULL) { + return -1; + } assert(mapping->mode & MODE_DIRECTORY); ret =3D commit_direntries(s, first_dir_index + i, array_index(&(s->mapping), mapping)); @@ -2522,6 +2564,10 @@ static int commit_one_file(BDRVVVFATState* s, assert(offset < size); assert((offset % s->cluster_size) =3D=3D 0); =20 + if (mapping =3D=3D NULL) { + return -1; + } + for (i =3D s->cluster_size; i < offset; i +=3D s->cluster_size) c =3D modified_fat_get(s, c); =20 @@ -2668,6 +2714,9 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* = s) if (commit->action =3D=3D ACTION_RENAME) { mapping_t* mapping =3D find_mapping_for_cluster(s, commit->param.rename.cluster); + if (mapping =3D=3D NULL) { + return -1; + } char* old_path =3D mapping->path; =20 assert(commit->path); @@ -2692,6 +2741,9 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* = s) if (is_file(d) || (is_directory(d) && !is_dot(d)))= { mapping_t* m =3D find_mapping_for_cluster(s, begin_of_direntry(d)); + if (m =3D=3D NULL) { + return -3; + } int l =3D strlen(m->path); char* new_path =3D g_malloc(l + diff + 1); =20 @@ -3193,6 +3245,10 @@ static int enable_write_target(BlockDriverState *bs,= Error **errp) =20 backing =3D bdrv_new_open_driver(&vvfat_write_target, NULL, BDRV_O_ALL= OW_RDWR, &error_abort); + if (!backing) { + ret =3D -EINVAL; + goto err; + } *(void**) backing->opaque =3D s; =20 bdrv_set_backing_hd(s->bs, backing, &error_abort); --=20 1.8.3.1 From nobody Sun Feb 8 11:21:41 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=oracle.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1535739748451104.51951482247068; Fri, 31 Aug 2018 11:22:28 -0700 (PDT) Received: from localhost ([::1]:56134 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvo3r-0007RE-Th for importer@patchew.org; Fri, 31 Aug 2018 14:22:23 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50101) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvnwI-0007Gh-RK for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fvnwG-0005vL-6d for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:34 -0400 Received: from userp2130.oracle.com ([156.151.31.86]:50552) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fvnwF-0005uu-Sm for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:32 -0400 Received: from pps.filterd (userp2130.oracle.com [127.0.0.1]) by userp2130.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7VIDeKE061907 for ; Fri, 31 Aug 2018 18:14:31 GMT Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp2130.oracle.com with ESMTP id 2m2xhucv7h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:31 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIEUbT025954 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:30 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w7VIEUWx007765 for ; Fri, 31 Aug 2018 18:14:30 GMT Received: from ol7.nl.oracle.com (/10.175.61.138) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 31 Aug 2018 11:14:29 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id : in-reply-to : references; s=corp-2018-07-02; bh=vTDxGyvVZbHEbIZbP2zN/o73/c3ZDAMAQtl/nrrPfT0=; b=4hu4C/zP/sqzu+CfBSFSj4jp9dlhTr6vAtBoAx4Z+xUlH/ywjpqQv8Xb4DrQGWfmJYa6 Qxcyu9xiTwJVbnl+GjDomn50nuRTf5noeR6i4qJJpblRmrjuB1CNhxD85ddQdVIRsgux 1UCEVhIPf3DSIQBsPtqRDpRHFvrhVV/42QKYAr7dTZGf2QIytrBmj7GfS+a1NdSOnqsJ 5VePhYuJ58my9epBxCoey2PfffnmbbqiReOT1gELGM7Lb842/dBsmCuumM4wdjokp7jH hiSLj9ZScbcOqYia2D6ZyXsTs8Mw4Rkjvo9uDSriTiVVYvnNJRQ9PS/QRZ+BjGbGrii8 6g== From: Liam Merwick To: qemu-devel@nongnu.org Date: Fri, 31 Aug 2018 19:16:10 +0100 Message-Id: <1535739372-24454-7-git-send-email-Liam.Merwick@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> References: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=9001 signatures=668708 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=806 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808310183 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 156.151.31.86 Subject: [Qemu-devel] [PATCH v3 6/8] block: dump_qlist() may dereference a Null pointer X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDMRC_1 RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" A NULL 'list' passed into function dump_qlist() isn't correctly validated and can be passed to qlist_first() where it is dereferenced. Given that dump_qlist() is static, and callers already do the right thing, just add an assert to catch future potential bugs. Signed-off-by: Liam Merwick Reviewed-by: Eric Blake --- block/qapi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/block/qapi.c b/block/qapi.c index c66f949db839..e81be604217c 100644 --- a/block/qapi.c +++ b/block/qapi.c @@ -740,6 +740,8 @@ static void dump_qlist(fprintf_function func_fprintf, v= oid *f, int indentation, const QListEntry *entry; int i =3D 0; =20 + assert(list); + for (entry =3D qlist_first(list); entry; entry =3D qlist_next(entry), = i++) { QType type =3D qobject_type(entry->value); bool composite =3D (type =3D=3D QTYPE_QDICT || type =3D=3D QTYPE_Q= LIST); --=20 1.8.3.1 From nobody Sun Feb 8 11:21:41 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=oracle.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 15357395926091007.1512847605627; Fri, 31 Aug 2018 11:19:52 -0700 (PDT) Received: from localhost ([::1]:56120 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvo1P-0005f9-Hq for importer@patchew.org; Fri, 31 Aug 2018 14:19:51 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50102) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvnwI-0007Gi-RL for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fvnwH-0005vs-5T for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:34 -0400 Received: from aserp2120.oracle.com ([141.146.126.78]:55990) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fvnwG-0005vV-Ur for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:33 -0400 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7VIDudm094223 for ; Fri, 31 Aug 2018 18:14:32 GMT Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by aserp2120.oracle.com with ESMTP id 2m2y2q4vjm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:32 +0000 Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIEVPk025987 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:31 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w7VIEVgH029612 for ; Fri, 31 Aug 2018 18:14:31 GMT Received: from ol7.nl.oracle.com (/10.175.61.138) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 31 Aug 2018 11:14:30 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id : in-reply-to : references; s=corp-2018-07-02; bh=QNp9Gqcw4CYoto1SBRF18IVWZhes4hOn8Jls+CBfygg=; b=fYRkF9TPg0inwabDo5FDq72GweDmPqWCpg1w/QgyOmVEEInONDZhb8IKavpvsvISz9hR SyIBTLg9GsOEBUU0yK3T+FDQiqwiWkVan6bNZirQttiUUimz7+AJ4BcVtuB4pbcZ3VaX GewMUHyim2uLosieeG+qfgLgG3b0ZWrM6eKU1Plvgl9pvCOOEnvUmqewa0aETZYt8tiu 0TR25WIBysAPpwvAox/tA8gvjZG2bFIyzfwPeCyt/QBtO3ifxaV9YJUOiDtT+TQp9R2p sRHg7iO3BO38nq5olLUCLLX9zZBB40cggaUklEoNkVed7wBlvLNGRwJnD2pCTNEwSY8q Bg== From: Liam Merwick To: qemu-devel@nongnu.org Date: Fri, 31 Aug 2018 19:16:11 +0100 Message-Id: <1535739372-24454-8-git-send-email-Liam.Merwick@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> References: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=9001 signatures=668708 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808310183 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 141.146.126.78 Subject: [Qemu-devel] [PATCH v3 7/8] io: potential unnecessary check in qio_channel_command_new_spawn() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDMRC_1 RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" In qio_channel_command_new_spawn() the 'flags' variable is checked to see if /dev/null should be used for stdin or stdout; first with O_RDONLY and then O_WRONLY. However the second check for O_WRONLY is only needed if flags !=3D O_RDONLY and therefore should be an else if statement. This minor optimization has the added benefit of suppressing a warning from a static analysis tool (Parfait) which incorrectly reported an incorrect checking of flags in qio_channel_command_new_spawn() could result in an uninitialized file descriptor being used. Removing this noise will help us better find real issues. Signed-off-by: Liam Merwick Reviewed-by: Eric Blake --- io/channel-command.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/io/channel-command.c b/io/channel-command.c index 3e7eb17eff54..82acd3234915 100644 --- a/io/channel-command.c +++ b/io/channel-command.c @@ -61,8 +61,7 @@ qio_channel_command_new_spawn(const char *const argv[], =20 if (flags =3D=3D O_RDONLY) { stdinnull =3D true; - } - if (flags =3D=3D O_WRONLY) { + } else if (flags =3D=3D O_WRONLY) { stdoutnull =3D true; } =20 --=20 1.8.3.1 From nobody Sun Feb 8 11:21:41 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=oracle.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1535739748714775.5850226761327; Fri, 31 Aug 2018 11:22:28 -0700 (PDT) Received: from localhost ([::1]:56135 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvo3t-0007Sd-Qn for importer@patchew.org; Fri, 31 Aug 2018 14:22:25 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50118) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvnwK-0007J4-Le for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:39 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fvnwH-0005wC-Un for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:36 -0400 Received: from userp2120.oracle.com ([156.151.31.85]:40822) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fvnwH-0005vo-MG for qemu-devel@nongnu.org; Fri, 31 Aug 2018 14:14:33 -0400 Received: from pps.filterd (userp2120.oracle.com [127.0.0.1]) by userp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7VIEW8V049799 for ; Fri, 31 Aug 2018 18:14:32 GMT Received: from userv0021.oracle.com (userv0021.oracle.com [156.151.31.71]) by userp2120.oracle.com with ESMTP id 2m2yrqvs6t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:32 +0000 Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0021.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIEWiV026035 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 31 Aug 2018 18:14:32 GMT Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id w7VIEW3D023713 for ; Fri, 31 Aug 2018 18:14:32 GMT Received: from ol7.nl.oracle.com (/10.175.61.138) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 31 Aug 2018 11:14:31 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id : in-reply-to : references; s=corp-2018-07-02; bh=R4G6udPkyEsTbPJ+U+A8Ix4+gdtgvAduxrM6UId9wr4=; b=e1P0nfKrA7teWvap2pKNixIDwiqNIE2kuI+77Ls5beiOwMEZubJgZbU1LjDV6Xw9CZrs 6JYGgkIKeFXi+UcGrXYwUHaQYY7Wv6twYAjQGcU5nJytCShVivSu6S8QSUTCut+pAj5+ Rvci8tsPyvKZaagPcAa1TYf7g8qrWGAvRy4XnFct+h1R0QJV+2trfuxShqymzmaCdV3+ y3prAwUKUvXg+V8ypNrYVqywEabbAV+1d5pHpWSY4JdZE7QvGXL+zcVYtEIWg6+jf6/d IdI0+sHgQ81k6Sxkbbg3FLDhHodN7ZT/Oa0vOFMscOksJ3hJylJsa+bL4UAvf/Tnsv2K 0Q== From: Liam Merwick To: qemu-devel@nongnu.org Date: Fri, 31 Aug 2018 19:16:12 +0100 Message-Id: <1535739372-24454-9-git-send-email-Liam.Merwick@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> References: <1535739372-24454-1-git-send-email-Liam.Merwick@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=9001 signatures=668708 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=1 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=820 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808310183 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 156.151.31.85 Subject: [Qemu-devel] [PATCH v3 8/8] qcow2: Read outside array bounds in qcow2_pre_write_overlap_check() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDMRC_1 RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The commit for 0e4e4318eaa5 increments QCOW2_OL_MAX_BITNR but does not add an array entry for QCOW2_OL_BITMAP_DIRECTORY_BITNR to metadata_ol_names= []. As a result, an array dereference of metadata_ol_names[8] in qcow2_pre_write_overlap_check() could result in a read outside of the array= bounds. Fixes: 0e4e4318eaa5 ('qcow2: add overlap check for bitmap directory') Cc: Vladimir Sementsov-Ogievskiy Signed-off-by: Liam Merwick Reviewed-by: Eric Blake Reviewed-by: Max Reitz --- block/qcow2-refcount.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c index 3c539f02e5ec..46082aeac1d6 100644 --- a/block/qcow2-refcount.c +++ b/block/qcow2-refcount.c @@ -2719,15 +2719,17 @@ int qcow2_check_metadata_overlap(BlockDriverState *= bs, int ign, int64_t offset, } =20 static const char *metadata_ol_names[] =3D { - [QCOW2_OL_MAIN_HEADER_BITNR] =3D "qcow2_header", - [QCOW2_OL_ACTIVE_L1_BITNR] =3D "active L1 table", - [QCOW2_OL_ACTIVE_L2_BITNR] =3D "active L2 table", - [QCOW2_OL_REFCOUNT_TABLE_BITNR] =3D "refcount table", - [QCOW2_OL_REFCOUNT_BLOCK_BITNR] =3D "refcount block", - [QCOW2_OL_SNAPSHOT_TABLE_BITNR] =3D "snapshot table", - [QCOW2_OL_INACTIVE_L1_BITNR] =3D "inactive L1 table", - [QCOW2_OL_INACTIVE_L2_BITNR] =3D "inactive L2 table", + [QCOW2_OL_MAIN_HEADER_BITNR] =3D "qcow2_header", + [QCOW2_OL_ACTIVE_L1_BITNR] =3D "active L1 table", + [QCOW2_OL_ACTIVE_L2_BITNR] =3D "active L2 table", + [QCOW2_OL_REFCOUNT_TABLE_BITNR] =3D "refcount table", + [QCOW2_OL_REFCOUNT_BLOCK_BITNR] =3D "refcount block", + [QCOW2_OL_SNAPSHOT_TABLE_BITNR] =3D "snapshot table", + [QCOW2_OL_INACTIVE_L1_BITNR] =3D "inactive L1 table", + [QCOW2_OL_INACTIVE_L2_BITNR] =3D "inactive L2 table", + [QCOW2_OL_BITMAP_DIRECTORY_BITNR] =3D "bitmap directory", }; +QEMU_BUILD_BUG_ON(QCOW2_OL_MAX_BITNR !=3D ARRAY_SIZE(metadata_ol_names)); =20 /* * First performs a check for metadata overlaps (through --=20 1.8.3.1