[Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route()

Peter Maydell posted 1 patch 5 years, 1 month ago
Test docker-mingw@fedora passed
Test asan passed
Test checkpatch passed
Test docker-clang@ubuntu passed
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20190205174207.9278-1-peter.maydell@linaro.org
Maintainers: Laurent Vivier <laurent@vivier.eu>, Riku Voipio <riku.voipio@iki.fi>
linux-user/syscall.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
[Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route()
Posted by Peter Maydell 5 years, 1 month ago
Coverity warns (CID 1390634) that open_net_route() is not
checking the return value from sscanf(), which means that
it might then use values that aren't initialized.

Errors here should in general not happen since we're passing
an assumed-good /proc/net/route from the host kernel, but
if we do fail to parse a line then just skip it in the output
we pass to the guest.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/syscall.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index b5786d4fc1f..894678aa8b4 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6762,9 +6762,15 @@ static int open_net_route(void *cpu_env, int fd)
         char iface[16];
         uint32_t dest, gw, mask;
         unsigned int flags, refcnt, use, metric, mtu, window, irtt;
-        sscanf(line, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
-                     iface, &dest, &gw, &flags, &refcnt, &use, &metric,
-                     &mask, &mtu, &window, &irtt);
+        int fields;
+
+        fields = sscanf(line,
+                        "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
+                        iface, &dest, &gw, &flags, &refcnt, &use, &metric,
+                        &mask, &mtu, &window, &irtt);
+        if (fields != 11) {
+            continue;
+        }
         dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
                 iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
                 metric, tswap32(mask), mtu, window, irtt);
-- 
2.20.1


Re: [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route()
Posted by Philippe Mathieu-Daudé 5 years, 1 month ago
On 2/5/19 6:42 PM, Peter Maydell wrote:
> Coverity warns (CID 1390634) that open_net_route() is not
> checking the return value from sscanf(), which means that
> it might then use values that aren't initialized.
> 
> Errors here should in general not happen since we're passing
> an assumed-good /proc/net/route from the host kernel, but
> if we do fail to parse a line then just skip it in the output
> we pass to the guest.
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

> ---
>  linux-user/syscall.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index b5786d4fc1f..894678aa8b4 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -6762,9 +6762,15 @@ static int open_net_route(void *cpu_env, int fd)
>          char iface[16];
>          uint32_t dest, gw, mask;
>          unsigned int flags, refcnt, use, metric, mtu, window, irtt;
> -        sscanf(line, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> -                     iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> -                     &mask, &mtu, &window, &irtt);
> +        int fields;
> +
> +        fields = sscanf(line,
> +                        "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> +                        iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> +                        &mask, &mtu, &window, &irtt);
> +        if (fields != 11) {
> +            continue;
> +        }
>          dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
>                  iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
>                  metric, tswap32(mask), mtu, window, irtt);
> 

Re: [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route()
Posted by Stefano Garzarella 5 years, 1 month ago
On Tue, Feb 05, 2019 at 05:42:07PM +0000, Peter Maydell wrote:
> Coverity warns (CID 1390634) that open_net_route() is not
> checking the return value from sscanf(), which means that
> it might then use values that aren't initialized.
> 
> Errors here should in general not happen since we're passing
> an assumed-good /proc/net/route from the host kernel, but
> if we do fail to parse a line then just skip it in the output
> we pass to the guest.
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>  linux-user/syscall.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>

Thanks,
Stefano

Re: [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route()
Posted by Laurent Vivier 5 years, 1 month ago
On 05/02/2019 18:42, Peter Maydell wrote:
> Coverity warns (CID 1390634) that open_net_route() is not
> checking the return value from sscanf(), which means that
> it might then use values that aren't initialized.
> 
> Errors here should in general not happen since we're passing
> an assumed-good /proc/net/route from the host kernel, but
> if we do fail to parse a line then just skip it in the output
> we pass to the guest.
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>  linux-user/syscall.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index b5786d4fc1f..894678aa8b4 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -6762,9 +6762,15 @@ static int open_net_route(void *cpu_env, int fd)
>          char iface[16];
>          uint32_t dest, gw, mask;
>          unsigned int flags, refcnt, use, metric, mtu, window, irtt;
> -        sscanf(line, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> -                     iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> -                     &mask, &mtu, &window, &irtt);
> +        int fields;
> +
> +        fields = sscanf(line,
> +                        "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> +                        iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> +                        &mask, &mtu, &window, &irtt);
> +        if (fields != 11) {
> +            continue;
> +        }
>          dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
>                  iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
>                  metric, tswap32(mask), mtu, window, irtt);
> 

Reviewed-by: Laurent Vivier <laurent@vivier.eu>


Re: [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route()
Posted by Laurent Vivier 5 years, 1 month ago
On 05/02/2019 18:42, Peter Maydell wrote:
> Coverity warns (CID 1390634) that open_net_route() is not
> checking the return value from sscanf(), which means that
> it might then use values that aren't initialized.
> 
> Errors here should in general not happen since we're passing
> an assumed-good /proc/net/route from the host kernel, but
> if we do fail to parse a line then just skip it in the output
> we pass to the guest.
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>  linux-user/syscall.c | 12 +++++++++---
>  1 file changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index b5786d4fc1f..894678aa8b4 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -6762,9 +6762,15 @@ static int open_net_route(void *cpu_env, int fd)
>          char iface[16];
>          uint32_t dest, gw, mask;
>          unsigned int flags, refcnt, use, metric, mtu, window, irtt;
> -        sscanf(line, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> -                     iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> -                     &mask, &mtu, &window, &irtt);
> +        int fields;
> +
> +        fields = sscanf(line,
> +                        "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> +                        iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> +                        &mask, &mtu, &window, &irtt);
> +        if (fields != 11) {
> +            continue;
> +        }
>          dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
>                  iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
>                  metric, tswap32(mask), mtu, window, irtt);
> 


Applied to my linux-user branch.

Thanks,
Laurent