From nobody Sun May 19 01:15:28 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1594324868; cv=none; d=zohomail.com; s=zohoarc; b=m1jC0ecPKMiUHM5eDezPjncR/DmY00X/89KCQOXFgjR3duOibEUYaAKrzI8aGF2JcRoWz5TpRsOT9LKVU160dPRd61aRTv6TPVZRkjxpU1zTQXwvK8Nd6NCx7ereOo8LFvACYKyUbSjA9W5Lrh/NUlNYkQua7LlVLfCrTJ6uiv8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1594324868; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=Ac+q2aDF63BgK2Gse/A08rLdK6cRdtQPEMbL6actjV0=; b=gPtYI4vE8qBo2fQqalljy6mY148KIG1vU/MqLFt/7Ml3dUIdD91HaH4FaJv8VGAjQY2SJQ0bFs06bR6Qg6E2C4X9d3C2EZCuaE5MsPAWe2cbY4bwCjIdvSpmN+6WV1vnmKxoHOp8wCPSO/AMl0al+LlGwM8VTKbhpBxYDFWOEWs= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1594324868355567.588472184074; Thu, 9 Jul 2020 13:01:08 -0700 (PDT) Received: from localhost ([::1]:52838 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jtcjC-0004Yu-FC for importer@patchew.org; Thu, 09 Jul 2020 16:01:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:34294) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jtciR-00043h-8H for qemu-devel@nongnu.org; Thu, 09 Jul 2020 16:00:19 -0400 Received: from mout.kundenserver.de ([212.227.126.135]:49231) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jtciP-0002Kk-Bo for qemu-devel@nongnu.org; Thu, 09 Jul 2020 16:00:18 -0400 Received: from localhost.localdomain ([78.238.229.36]) by mrelayeu.kundenserver.de (mreue011 [212.227.15.167]) with ESMTPSA (Nemesis) id 1MQusJ-1kDbTe1K0F-00NxSR; Thu, 09 Jul 2020 22:00:13 +0200 From: Laurent Vivier To: qemu-devel@nongnu.org Subject: [PATCH] linux-user: Fix Coverity CID 1430271 / CID 1430272 Date: Thu, 9 Jul 2020 22:00:10 +0200 Message-Id: <20200709200010.1016741-1-laurent@vivier.eu> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Provags-ID: V03:K1:GpyrjEUPqB6WnAbaC/p+nEawQ3wS2xVRtIpW+rzD4S00smM/Wsl DicUY42NHeggKh40PsCHI3tg8L+1udI11piTmBu3tvqx1n5y1J4JEpADY6TVjRwXOW0Oe06 aWl31bIcyhBjQzEY28SFl6Z4ios/pO7C58+3BnwuB6zXAgBYvytF6gsJhsbJHTyPoU/c/8g Rxgn0j9GmYBs9k4vryCpg== X-UI-Out-Filterresults: notjunk:1;V03:K0:GTONDieBkDk=:stD3rtAlMkvlA1Otk59oIV rP/ujvJ9SmNJrtq1mV3dpgMUe/5xfKuPnTgfJ/dOopQ74/rcv5QVm1kt+NZo4e/4apqDdbtCQ y13Q0Qi86m8NBlHiC+V5CHoKwb+T63Y3hvRvu6FFkQRTqD/cT9ew27H/K47BCBEyeVr8yjRxt OiBEOC2Yw13EhJDPjklWt5mcnqf1YEmYueS6bZOxL/0LQtii4pulfrhfr8vWLa1jmJqhGzk65 S2v3CbAEoxBdztWv5Dnx8zGiO/S1Q8mYuBD/tyFIyg8LHvfed/ZkUGgDpHKg0mMe6wKiaTsrZ 802NhkpxLpeSqeE5l2gAIDiFnEAPtQGH1QncSf/sKLIpR7yVEfVHzH7n4s5l8UGHVgcXfDVvy w5NaenO1fBBlKsy/f15ghDFgt8K3K0OFbFEck5OjlFeczTbagWDGkc3mBRk54IKgpc5O/7PLp ehhtyjummdjkpu3xsf+h+8eqg1i3c/kvhTWzUE/xMm8J4W7pDmqBlGW4s7l1a2hgyLqRYZVPR K54P6Anognx7YI/cHvPXVh3WnG733uTr3lAtO5sOIxTqFzThdk/Lqg3+kERkspDyhNCPNCJbO 9jxvyb3j8KNWGikXVCofJMvhNh3IlCmk0z5cUeDKpqLzTzdU4FfaW0Gw9gqT30h1sAyUwQrge PMoLip/jGCMnaoUqYR6mozv6WJ/1h1T2GQBE8XSSr6RXURdrvIchgJmHZgGfidCE/k6XLgc+1 Z06YpQLqnMLIMObmeRNGFFZoZ7tMcjjPN10Tp1QKxijDfVg70I6/vkncR0OWNtLsCM67/DdhQ O1/b04YiYKC18BBQtzokBM0GqpZIg+39f0zw+iR0w/92XxCk/YBf5lxO6FeGsvQoY8OYx86 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: none client-ip=212.227.126.135; envelope-from=laurent@vivier.eu; helo=mout.kundenserver.de X-detected-operating-system: by eggs.gnu.org: First seen = 2020/07/09 16:00:15 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] X-Spam_score_int: -28 X-Spam_score: -2.9 X-Spam_bar: -- X-Spam_report: (-2.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Laurent Vivier , Filip Bozuta Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" In new functions print_ioctl() and print_syscall_ret_ioctl(), we don't check if lock_user() returns NULL and this would cause a segfault in thunk_print(). If lock_user() returns NULL don't call thunk_print() but prints only the value of the (invalid) pointer. Tested with: # cat ioctl.c #include #include int main(void) { int ret; ret =3D ioctl(STDOUT_FILENO, TCGETS, 0xdeadbeef); ret =3D ioctl(STDOUT_FILENO, TCSETSF, 0xdeadbeef); return 0; } # QEMU_STRACE=3D ./ioctl ... 578 ioctl(1,TCGETS,0xdeadbeef) =3D -1 errno=3D2 (Bad address) 578 ioctl(1,TCSETSF,0xdeadbeef) =3D -1 errno=3D2 (Bad address) ... # QEMU_STRACE=3D passwd ... 623 ioctl(0,TCGETS,0x3fffed04) =3D 0 ({}) 623 ioctl(0,TCSETSF,{}) =3D 0 ... Reported-by: Peter Maydell Fixes: 79482e5987c8 ("linux-user: Add strace support for printing arguments= of ioctl()") Signed-off-by: Laurent Vivier Reviewed-by: Peter Maydell --- linux-user/strace.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/linux-user/strace.c b/linux-user/strace.c index 5235b2260cdd..39554d903911 100644 --- a/linux-user/strace.c +++ b/linux-user/strace.c @@ -889,8 +889,12 @@ print_syscall_ret_ioctl(const struct syscallname *name= , abi_long ret, arg_type++; target_size =3D thunk_type_size(arg_type, 0); argptr =3D lock_user(VERIFY_READ, arg2, target_size, 1); - thunk_print(argptr, arg_type); - unlock_user(argptr, arg2, target_size); + if (argptr) { + thunk_print(argptr, arg_type); + unlock_user(argptr, arg2, target_size); + } else { + print_pointer(arg2, 1); + } qemu_log(")"); } } @@ -3119,8 +3123,12 @@ print_ioctl(const struct syscallname *name, arg_type++; target_size =3D thunk_type_size(arg_type, 0); argptr =3D lock_user(VERIFY_READ, arg2, target_size, 1= ); - thunk_print(argptr, arg_type); - unlock_user(argptr, arg2, target_size); + if (argptr) { + thunk_print(argptr, arg_type); + unlock_user(argptr, arg2, target_size); + } else { + print_pointer(arg2, 1); + } break; } break; --=20 2.26.2