From nobody Sat Sep 26 20:01:40 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1788733611; cv=none; d=zohomail.com; s=zohoarc; b=b0dEuiII4IQQvcF0aXkbm3lZe5h8c3Ym5pwxvfWfBvFEJTTEOgVbY+zM+ET1Bc8AqXkZlQGO7h50vsFn3UQwghbfnrj5Zjgpi18qZvmAGI09cVanNSQWvnWa9b80XD1hld767wK7jigvcQi+JWWjJ+Pkmc8/IuPfdFdAheQ6zGg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788733611; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=+4uuNQK1zpPkZmAqWCtHTvgbtV1c5bPJMqFIPzcmwcc=; b=ZAZ/1/+pMJ8BZoAwqro5TGlKm9HXqVSwXRpZQof1osPlX9kSCpYbpKeCGmqz01mQ05yBiVckKY3AHPeXtUUxtt3mz41tCVDrpj7RIEYr04UyIz2GMdJhHZ/DwklwlEkWsU4stWiUBXeHojOQ2qyRwA4ni+hL52asJgCCz8xltwE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1788733611949331.3131372983074; Sun, 6 Sep 2026 15:26:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x3LJN-0006FC-R0; Sun, 06 Sep 2026 18:26:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x3LJI-0006EZ-Vr for qemu-devel@nongnu.org; Sun, 06 Sep 2026 18:26:01 -0400 Received: from mx0b-0031df01.pphosted.com ([205.220.180.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x3LJH-0003Zl-4X for qemu-devel@nongnu.org; Sun, 06 Sep 2026 18:26:00 -0400 Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 686MPRVs2786949 for ; Sun, 6 Sep 2026 22:25:56 GMT Received: from mail-pg1-f198.google.com (mail-pg1-f198.google.com [209.85.215.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4ggany46ry-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sun, 06 Sep 2026 22:25:56 +0000 (GMT) Received: by mail-pg1-f198.google.com with SMTP id 41be03b00d2f7-c89704da8c7so3581822a12.0 for ; Sun, 06 Sep 2026 15:25:56 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3339ac24d7esm34936605eec.15.2026.09.06.15.25.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 06 Sep 2026 15:25:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= +4uuNQK1zpPkZmAqWCtHTvgbtV1c5bPJMqFIPzcmwcc=; b=n8nc5pSoFg+aIYZw 5p28Vg03uV9zzbnmaaAEjtEYsAJwyvACw+dvgomqOJ4bRTQJlc0RHmIIQVor6JmV t+BiiKfIqlKOltlZSXf93ZChNPZZo66Q5Mrm1YkJjkzxz2wfV3ClLjGm2puarkrX FI45HwPXYuyb1ERHWJ9uvOFN8BMFIcZX1qtGxH0OhXZrVbpL4lTx9UJyLcsg+n5E nzONSL/F5XQOgNBY3b044PhvGGCHTMt5z/fk5ETZTBYwFR32DG5yHC1IKzyYJYgZ lUKU8Su7BJ3u4yji+F4eyydAdlGsaLShWvPROIJEQGwjp0t9F1R4Jm4AkpKHPaC8 +Ys0xA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788733555; x=1789338355; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=+4uuNQK1zpPkZmAqWCtHTvgbtV1c5bPJMqFIPzcmwcc=; b=CFi3xKWhY4iBP9w0q3bBeLrr8ryko8ZRzDEwoNz2XBShhAgMQj2WZP8J7hoc71UGaj 30Wn3NP68PbEBXQGFejpww7O1GfQmeBQWj44ALOAKsHiE4E/V1LF9c/EnrCX46CBPidr esixQanz9zrzoKDyeG4mzcGH3wcgCzxMIsw32DoXy1VXoNJiAy17Qlijc1fKlFYAe7wl DXBvq1dJLq640u9PJrghKPuBNwc3UPkYORJG5WUL1xTlFKT8VLagghmmkuxMRb/sma4t tQX9IOvFtXVAMAA9eFMKqRMcbxIelSnmw5fO4Bk+dbulWzdynAcCF9mJrJ9xUgMm0p68 PcUw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788733555; x=1789338355; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=+4uuNQK1zpPkZmAqWCtHTvgbtV1c5bPJMqFIPzcmwcc=; b=TH66ah5dd15atZzxVmZefwNPfvEx90WmAGoG2n355C1hbUv27MM0rtwHM+wkkhdHLP J35UPboZp4vkeRGEDN75IAk9XGT4oEuOBgRLyGnc8ZZ3aUQMJGqARrbY8O1RcuvJPIIn 4FEkx7LASQFupTfauikNGPYnFMP/BySVFU+uFNAz8QnEE+G2dix7mCF7TSpHscC+Q61L PgBldg+yeVe79vlhB0PdfbbJElMeeKu47OvS3jnZpmcauphBrXmikf2+NmqNRyMeMgGq f0z8LTVJZkp8w5wiU8stgJIceL6btcvQAKU/H1B+gC+1+dFjeGHodcZ2k6jsjvJ7ZUpZ CIjQ== X-Gm-Message-State: AFuF++mPs7l0ta136oxDrr3qkds3RCnTBlEPLnGzoRZxwxo8EnPCDKRG Ag/J4FWCbkMkFr53l+sNjphNJ9tP3ZTv4Hqw/csJfHLC2UDHp7De2VLgB5r97Dqa6uuKZ9/J0uL /CK+JyV1ETKHAbSsvZjqeSJu8ODcx8NUI0hj6zmMT8o1FCpTlGWI32AbY+38l+PL7ww== X-Gm-Gg: AYBFou0JDZ372rhlc3EZSLBURxfvaUk4Bep/5dRSI9aiXYN9R8faVokRSkMbE/PrpAv aLa8mrr1GdyfEjcyNPI7dFT6AIjNXqKwxNGQ6fnXdnn9+y6JXB1DrtFl2KuLyNp6VwaOBZywTOV gQQuJlWkqbWN+s9KAmC1TcNFLq+ERL8j4SBIjD4/04BB4Kjjfs1QJ1y59xxZIvkPdHA4owRMOEm CRKkOLL1g2KzrpenawD0SLrth1i9fIXP5i+1LC/ifu6IEkoa08tK81PXbnK0RBNoNZf4kkdk9SH jU1oBmFDNgNKcBmu+2jEfZFXm/WtFKxCeGiQF5y85LTUiuNBmmr03/k4SQZsDgItk6mx2MO+JJ7 5SrJNwhcHcmyo/b3+OoZZYkEXWJx7Rtjp0dr+QHyP9/z6xaW7 X-Received: by 2002:a05:6a21:748e:b0:3d2:5eb3:596 with SMTP id adf61e73a8af0-3da3a043152mr29150357637.16.1788733555396; Sun, 06 Sep 2026 15:25:55 -0700 (PDT) X-Received: by 2002:a05:6a21:748e:b0:3d2:5eb3:596 with SMTP id adf61e73a8af0-3da3a043152mr29150320637.16.1788733554832; Sun, 06 Sep 2026 15:25:54 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: Pierrick Bouvier , peter.maydell@linaro.org, Brian Cain Subject: [PATCH 1/3] target/hexagon: Fix semihosting OPEN filename handling Date: Sun, 6 Sep 2026 15:25:49 -0700 Message-Id: <20260906222551.3712954-2-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260906222551.3712954-1-brian.cain@oss.qualcomm.com> References: <20260906222551.3712954-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Authority-Analysis: v=2.4 cv=X45i7mTe c=1 sm=1 tr=0 ts=6a9de874 cx=c_pps a=Qgeoaf8Lrialg5Z894R3/Q==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=wm7e5FjlxgvFdPWeLvoA:9 a=QEXdDO2ut3YA:10 a=x9snwWr2DeNwDh03kgHS:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-ORIG-GUID: iEJsC3CeIJtJsOT44yUOVNnzFsj6yFup X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA2MDI1MCBTYWx0ZWRfX+lKEmX3g0evF 28QJPQWqGDvqPnUNUVK0gyhst9Ix1eveuzN6fHDo1jI37AgggKUUuatnskI/mwC7apW4jJ85IeQ GiNRXybGLJ3Mwzoy2rCt2zNy6njoRPPNYXsILIE+raEhT+h8fnqtQYYtNNFmPhyko5lWJ6CXaok EWYr2G4MqcqDuCMiJ6vRsuKgRlQPunS3xqWOepfbfjeH5317FZ87cJrUqkcb5sOJPMfmhUPu2yV Z3oDfpJ0DBFxxxNIPsXaFsA1MxY6Hka4PxZXKMoii9/Cm2PINKLmataGQjKxxqLpV4t3y4uxDRJ C4tfNiahcSp5Xu0RkMiaY7V85qLCvaUdbj6qjTauVUPU0CD3V/7gVJwaCTXyqPHetHGenuLVDcy mLmLyWr7zUZCgyGywL2Jg+ZsGw4rBwSE5LFNZYrYGsVq0MpIHUMwDMdZK/6x9m2jo9cFFfbSzOA eeIdZduDJ+KK3rKBhbw== X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA2MDI1MCBTYWx0ZWRfX52KDgW/zjrTK J62HjdEo3TmZGuDaQYHetkPGfi5id5bPejptkK6rxgwudSiU0M6MM4W2HyU1ZdrlFA20lwaCLCc TCp5MQTOlzqRg/TW9swwMzhywDKiDjc= X-Proofpoint-GUID: iEJsC3CeIJtJsOT44yUOVNnzFsj6yFup X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-06_03,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 bulkscore=0 suspectscore=0 clxscore=1015 adultscore=0 impostorscore=0 malwarescore=0 lowpriorityscore=0 spamscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609060250 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.180.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0b-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1788733619693154100 HEX_SYS_OPEN copied guest bytes into a fixed-size buffer until it found a N= UL. A missing terminator could overrun that buffer, so use lock_user_string() i= nstead. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/hexswi.c | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index 75f0a9cc520..cb6a061af16 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -28,6 +28,7 @@ #include "semihosting/console.h" #include "semihosting/syscalls.h" #include "semihosting/guestfd.h" +#include "semihosting/uaccess.h" #include "system/runstate.h" =20 /* non-arm-compatible semihosting calls */ @@ -461,31 +462,14 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 case HEX_SYS_OPEN: { - char filename[BUFSIZ]; + char *filename; target_ulong physical_filename_addr; unsigned int filemode; - int length; int real_openmode; int ret, err =3D 0; - int i =3D 0; =20 hexagon_read_memory(env, swi_info, 4, &physical_filename_addr, ret= addr); hexagon_read_memory(env, swi_info + 4, 4, &filemode, retaddr); - hexagon_read_memory(env, swi_info + 8, 4, &length, retaddr); - - if (length >=3D BUFSIZ) { - qemu_log_mask(LOG_GUEST_ERROR, - "%s: filename too large (%d)\n", - __func__, length); - semi_cb(cs, -1, ENAMETOOLONG); - break; - } - - do { - hexagon_read_memory(env, physical_filename_addr + i, 1, - &filename[i], retaddr); - i++; - } while (filename[i - 1]); =20 /* convert ARM ANGEL filemode into host filemode */ if (filemode < ARRAY_SIZE(angel_to_host_filemode_table)) { @@ -498,6 +482,12 @@ static void sim_handle_trap0(CPUHexagonState *env) break; } =20 + filename =3D lock_user_string(physical_filename_addr); + if (!filename) { + semi_cb(cs, -1, EFAULT); + break; + } + if (strcmp(filename, ":tt") =3D=3D 0 && qemu_semihosting_console_has_chardev()) { ret =3D alloc_guestfd(); @@ -513,6 +503,7 @@ static void sim_handle_trap0(CPUHexagonState *env) ret =3D guestfd; } } + unlock_user(filename, physical_filename_addr, 0); semi_cb(cs, ret, err); } break; --=20 2.34.1 From nobody Sat Sep 26 20:01:40 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1788733620; cv=none; d=zohomail.com; s=zohoarc; b=QJLML+qeLMmc/eERczqnihu4iENCRwYF2+c9Mmg4bvbokF2D0VRm8aetG9TaxKBPA4FPMX4iRhwM6dCMUNrLJ5QnaTlnY6gNSkxGxXIrVQOp7GYR8iLo7uMD6Titg7PY4k7E/EeDJ0t+eHsk8Y/qnPbYZQLsqdks3mgNfX+W39o= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788733620; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=yagXDdt/EXPs9+Fn5yPiZj+H0jEXPpISU9Tk/oZrPSA=; b=jBm9eCtqnyP5XfpFZDWMu9A1m+8v7rapBxyD2jOeBggJ5UQIo2KEtr5PuT2UdkVE5mGK/VpK7PEIcRjB85fY/b0/B9j6CcXwKCvAX7RJgIq4eUyXNKLs5atD2IX1qUtGErgWxfeg/ajvztFkToPlYDpbfiKXgYpkY/r/akSUzek= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1788733620885974.8076580163194; Sun, 6 Sep 2026 15:27:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x3LJR-0006GJ-Ge; Sun, 06 Sep 2026 18:26:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x3LJK-0006Eo-Ak for qemu-devel@nongnu.org; Sun, 06 Sep 2026 18:26:02 -0400 Received: from mx0b-0031df01.pphosted.com ([205.220.180.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x3LJI-0003a5-Kt for qemu-devel@nongnu.org; Sun, 06 Sep 2026 18:26:02 -0400 Received: from pps.filterd (m0279868.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 686LAgbg2006022 for ; Sun, 6 Sep 2026 22:25:58 GMT Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4ggadhm8v5-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sun, 06 Sep 2026 22:25:57 +0000 (GMT) Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-cc44d708055so5308652a12.0 for ; Sun, 06 Sep 2026 15:25:57 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3339ac24d7esm34936605eec.15.2026.09.06.15.25.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 06 Sep 2026 15:25:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= yagXDdt/EXPs9+Fn5yPiZj+H0jEXPpISU9Tk/oZrPSA=; b=PfUG32nHPlU7JQca 1V7pm37uco01Wjtcz/ewPnPk52qX48izipESsr+HqkjsBGjufnBtutn6rhz6pxVA CBmxnA4/S9pQd7FcI1CCDP/9YdEKWw4kjguj4MwT+lU3Gebd4g4xsEOivi0spQFw 7V85VDiqllGIrBgNVD0/uY60OAeT2aQKwjxVsnBEW+i4QcLIpBLGdxo8Y8AcXNMS z5W5n09d5x8glPwH1RQ6uteYuz908bfXVPn8LK/votxrT4iMxP1lMt0DUgoBdohm 8LzwKW0GlaTC0meJ5idKShkBqLOIZQxOxpoMncIVDBN27OVvtlWAVfvKSBMJyrPI 102elg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788733557; x=1789338357; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=yagXDdt/EXPs9+Fn5yPiZj+H0jEXPpISU9Tk/oZrPSA=; b=Or2yMG6sLZWCGG4zg30TJzi3kEyD7n69xTOs5uRMdctFJAfqcExbfbacQKgsvS2HIt ReHsgGbHM6IotQTg9WotkwG1iNET+LqBjlDGgp9clT4dfM+wHPMZCQEv5+CfpO7TN/j7 qFzFZP8dghvy3tSNZar8Z9GrTS1GsWMtYi2zmj7zsPDAvdLeqlIn+gPig1gLOHpAoeVU kB/68Lwtg6TIc20lFytCGayoWX5ncwdrH8QkElmR9lgpEru/YIg/aYM2XqBgsq2foSqg BtpCXC6HeZZaBpf3NlMlZhH6bZ0glzTr6bpDZY3aKrPkE03w1x8Y9aVlW6c8Fc1xmQbQ XGVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788733557; x=1789338357; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=yagXDdt/EXPs9+Fn5yPiZj+H0jEXPpISU9Tk/oZrPSA=; b=Rdkdnx1cTS1MYpJ2kPb9Sfe61clsU+q2uq3or1X5tdN77u8yksixva/FepBba+WSAJ YiWduEVrxpzu22ZZkGGYxqRk42gESfpzzRBJm81GzpxW2JTArligNC11+AbCInxPGXfO 9S/TLgGv09HpMJ1D4fIj7KU9NNdukajSR9dpOk2k3uBkI43YrgepN9V1hRro9az+34zR M1tlQIOJ+JEJH3RwIFvtabzSU15W3TzHvj49hXvaDT+vZNhmsySGfdo99XP58xtBeLdP x3jwsjWNgHnotnRo64mw31lBVbvi122vkfJcCN+X4qjpBVG6qF+rR43sIULzoooUx+r7 4NhQ== X-Gm-Message-State: AFuF++m9Vgphq9hXRdNts/wQqbibT96avR7z6E2JZOb/+nJbNq+25dxt ZymV/8Ia60EcCFebbI2bCXN1KQhnRJAgrnDEHAlW4m/ixjgUZlsdRAp8JkC7eIe9MtNnLnMfwG3 cuAf9pJaBxgSWuwKvrnBi435Vu38r8m/rpOqg5Myg+OqXH1HbJyLfcwDm5+eBb7BfCQ== X-Gm-Gg: AYBFou26yUJ41m1jnFE6UECNH53J7Q4x6+rSgp2gHld55/TOr2jkWBWUZQV7IPckvDr zc6TNO9pqdv39Ak3fxzQ4JaWAh6ub66rgU6oU1vEZSWcuzLVnxobhv1mXJ1qz2G5fb/1dMYi5Lu fmUHh/f4JNNLd6ADAgS1bTyJzHYhYg+GL/QtP+tvmFyVif8646jQkWEfJL/g9EKUHHCpIsA3XQ7 7NvycAkW/Ohlds4UifROW9feFSLK5zW/kS1RWzG0ptjnCQT7y3NpYfERGrqDaDgJ27rL/wyIFMQ OvF5MY46ucaQyLATPttR1A1iwqTNNoJDRSEP023l+F89UBqSP9cg2HnmVCWrdrB3Va2AZfmuImW FaMo9FWfKt4PNacfMcmxGoy47yYzpRF0OJWDjBog9uR0jcX72 X-Received: by 2002:a17:90a:1c96:b0:39b:66ee:a14 with SMTP id 98e67ed59e1d1-39b66ee3442mr3244359a91.25.1788733557080; Sun, 06 Sep 2026 15:25:57 -0700 (PDT) X-Received: by 2002:a17:90a:1c96:b0:39b:66ee:a14 with SMTP id 98e67ed59e1d1-39b66ee3442mr3244334a91.25.1788733556613; Sun, 06 Sep 2026 15:25:56 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: Pierrick Bouvier , peter.maydell@linaro.org, Brian Cain Subject: [PATCH 2/3] target/hexagon: Fix semihosting STAT filename handling Date: Sun, 6 Sep 2026 15:25:50 -0700 Message-Id: <20260906222551.3712954-3-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260906222551.3712954-1-brian.cain@oss.qualcomm.com> References: <20260906222551.3712954-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-ORIG-GUID: dnqGpPaFw7GMM79ZYfedNAFKwOlhITew X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA2MDI1MCBTYWx0ZWRfX4JYFLqZEmC60 FOJc9dy/5X4FIvbFydzrJZxnWpCkMnIdptZv6FKLwpfgza5X8IDMVRYR6spgZRodKAIPzjvayqR MgBbdw8scZNBLAdyl0GvwVpvFu5MMvFpjvcBq4ME+tA6raNHXXg9gUj6eUrPgcjFFhZCwCYoIi2 R6NROehJxLKBtOF0uQS+anl5clnULU4LPuwzR4SYFGKlIFK0BF3CVFdSAN7O1Le3H25+Siqh2dW NLqn2knHaFNYshVr+1FmDXQBL+TC5w3jAywrZSSHXZxw7CIqGpmOwezU2yxOOMgFp+r3NnPOXOo inmG+5TRYIfOq2H/r0V/9I0M5yemPbL5byts2cQZJ1eSjLlWxqWzJ/jaCfcP+2Db9iRppp5xGgX UB9qB+ZU+Oc6/C64A5L0c8xyEzT4b3+xov1uXrVhNRP/giAdRYKJwwRkOf4hk1UebFVulU/A7pn rJH1SWWVyOAJ7L3jOnQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA2MDI1MCBTYWx0ZWRfX3wftCCc6fsQI OeeseM/2Zxe0rMRjMHHdKYD6MV9VJKY9IOQx4H/p87ITDC0MANdGYpjoFtMRA0Vhi97LXSajcBz sdOpdF556VFKVoC7D8/pkH6ev41pwbQ= X-Authority-Analysis: v=2.4 cv=OceoyBTY c=1 sm=1 tr=0 ts=6a9de876 cx=c_pps a=oF/VQ+ItUULfLr/lQ2/icg==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=ZpdpYltYx_vBUK5n70dp:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=SeUakuFykayKsU5LqBsA:9 a=QEXdDO2ut3YA:10 a=3WC7DwWrALyhR5TkjVHa:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-GUID: dnqGpPaFw7GMM79ZYfedNAFKwOlhITew X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-06_03,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 bulkscore=0 priorityscore=1501 suspectscore=0 phishscore=0 malwarescore=0 impostorscore=0 adultscore=0 spamscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609060250 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.180.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0b-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1788733622585154100 HEX_SYS_STAT could pass an unterminated local filename buffer to stat() when the guest string filled it. Use lock_user_string() to safely map the guest = string instead. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Signed-off-by: Brian Cain Reviewed-by: Peter Maydell --- target/hexagon/hexswi.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index cb6a061af16..18d73b491a0 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -544,20 +544,20 @@ static void sim_handle_trap0(CPUHexagonState *env) struct stat st_buf; uint8_t *st_bufptr =3D (uint8_t *)&sys_stat; int rc, err =3D 0; - char filename[BUFSIZ]; + char *filename; target_ulong physical_filename_addr; target_ulong statBufferAddr; hexagon_read_memory(env, swi_info, 4, &physical_filename_addr, ret= addr); =20 if (what_swi =3D=3D HEX_SYS_STAT) { - int i =3D 0; - do { - hexagon_read_memory(env, physical_filename_addr + i, 1, - &filename[i], retaddr); - i++; - } while ((i < BUFSIZ) && filename[i - 1]); + filename =3D lock_user_string(physical_filename_addr); + if (!filename) { + semi_cb(cs, -1, EFAULT); + break; + } rc =3D stat(filename, &st_buf); err =3D errno; + unlock_user(filename, physical_filename_addr, 0); } else { int fd =3D physical_filename_addr; GuestFD *gf =3D get_guestfd(fd); --=20 2.34.1 From nobody Sat Sep 26 20:01:40 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1788733617; cv=none; d=zohomail.com; s=zohoarc; b=bZVcsLFYwx/dtE5VFl0UI2Qw23PhGMl6dLdVoFRzy+U18aHyMqu1KlvfV+e1hYzOwlU1EdUyt7R9sCD4c+Z6viD4x8hdNjIh3D3MYzzdnSOCQSUWSrPCSCxLQ24xzqQZqXFstwna43mHFxE3+w+Qc8LbEBlADsXeo3Z7UFZblTE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788733617; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=lymf1mpJPKqLFwRjRgvV1s6zoYYYzfPRa3SVc1O4Nq4=; b=Qzc+cudINYRFrhO/CdI3f92AHlcypagtAhmjnz/MeTy+rbItDkRnyAEQ94rTe4mgv0WWDwiq07RR7QMeI5L4x2TkJ54UmrH2AxdsnZQq4tDqfXQP5oVW7g5BnJqIHwmAI03zJFyHvhXCdagidDvSE9aBepxhjmVz/Dux4+8u6jw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1788733616948170.40406505993133; Sun, 6 Sep 2026 15:26:56 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x3LJR-0006G5-3F; Sun, 06 Sep 2026 18:26:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x3LJK-0006Ep-Bw for qemu-devel@nongnu.org; Sun, 06 Sep 2026 18:26:02 -0400 Received: from mx0a-0031df01.pphosted.com ([205.220.168.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x3LJI-0003a9-L7 for qemu-devel@nongnu.org; Sun, 06 Sep 2026 18:26:02 -0400 Received: from pps.filterd (m0279864.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 686L9LH3883795 for ; Sun, 6 Sep 2026 22:25:59 GMT Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4ggc8jc59g-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sun, 06 Sep 2026 22:25:58 +0000 (GMT) Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2d7293f13c6so35572425ad.2 for ; Sun, 06 Sep 2026 15:25:58 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3339ac24d7esm34936605eec.15.2026.09.06.15.25.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 06 Sep 2026 15:25:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= lymf1mpJPKqLFwRjRgvV1s6zoYYYzfPRa3SVc1O4Nq4=; b=QXrM3OSzGD3fHMPh zUvqNIBjSD9F66YVEQUv63B8x08h/pHBRmXotKsMG7ETH5HU3t3fgqlzcXRkitGf va3nJvDTk2seKPyI3BM8iP17ITTBEkPjqMU2AI6QC/nuSYmK7C9DFoaJGXPyI9si TweQ6U+wfMHQFZP8YLzr7p7xjl3d1PkN68+CeTnmEKPBjh1gV+9CVzt0LOPws3bg eDbzQX3IW8HmGamgOqKmNFGCqDCknwnUQc18BMFsQ6IFu3bUg/t+EKqtvkAzhyWm rD3qdfOKD6m01ZWe7vsdz8f378shV2YdFF7V9JRBvwAkZqP8kKZTKh/PpB267BF+ 8zQEyA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1788733558; x=1789338358; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=lymf1mpJPKqLFwRjRgvV1s6zoYYYzfPRa3SVc1O4Nq4=; b=cyXkRMuqKjLcCVMUWeJhKRjMKBBvJMLyJ0ctL9tvVjz4olypsmHPjHd+LkyhtI2OQw EgM79T3JIRHNN7MXF1ra/Uy3Eug5VSe8qkxlbSzqOYw4s2JcCdQyyaAuhdiqk6eVWszP NCU9NAqHFBcWZoMgNPPwzQhMPvm8vNEe1DryHoh7S4s0/ZBhDx1scKqJKffBn9cicn33 tiIvg2r2bo6Za0sgjU2KJ1a0qEFMNgJ+Pj9qK4kEgIv3FSylmm0DGv5f/5gZ405moliV rgEsvIcEf4iz8SAQ3B6J9lpLlUg6PygCANRcA20nBczmxcu/n1ziS/1JJ59Oin2xLIhc tyDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788733558; x=1789338358; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=lymf1mpJPKqLFwRjRgvV1s6zoYYYzfPRa3SVc1O4Nq4=; b=In7ZP05/2Fu1Tl4nIhstJGydvTQT7qHjblf/JXD3nRgeJiXZe2q6Zw0arelTF7TmMR FZiLnX8zKMPdFg3k9IEwcC8L/bXUTsPUjSmPzMwLAEMuz+vpXY+G4kPoQEPnQX3/xAUI /CbFkVOatksKZn+r7h7kjO/L/DJzl1SEIh3sEUEFBGkvbdf0jAnsmJKVhg4T0Lihjdr/ KpfwtVKMOaqW4in2eNbxLUal2AFRPrg4Nm8TcIm0sn7ka8qoIdsZ3pru+0ZZETcCSphS th9vGT4bUw2t4BAgGC44stp1aZc3jPTDCCRXzLhHgh9Bf8lTJ0ybw+/cS5G4nZVUcBKS nXAw== X-Gm-Message-State: AFuF++k4B8OY//5q/U+N1of3OgqFheTX73XaHcoDdtwOlsBqTD/4DnCb ESVxjDtv8+YitOUPX+1skcC47I5pIgcUp86yaOCo2Oxu/pC8nTBxlns/7PXNkk/ky/1KtYnXgPw ZoEy7Dc+jE82DN6Mnta0u97x1PM0A1ptcJsW8vsuA2dUhcjQn9QnzFM0lUMLg8JWXuQ== X-Gm-Gg: AYBFou0TuIvpRaD9tJV/VfT5/oeomkbeKrdWPCwceGV0E31zb0kprFHJBag/utVfI3Y zwJTxwIdbZ8Vhewt0F3Yt67mDd7JdKCW0yWMmy8V7jzUyw33p94R3rlq17OeD+viiIp7rKCUDbH h/ui162n5RbXZG7MVowO+RI0BTqm93R8EtDsD/DB74TIHX6fQ+0jWeZAUBKMTqfzOdPXcMTdChS EnJ0Juw1N8bRSrz3hc1OSHakQHccevZzg0NbPOdfoVuBg7DuN+Tu3UU33Bjbtq3JP23ceGaTvin UjzHDBOnslbYHIT1/AnOY7y+iibllA5luXCRzyWcanPTrGxgRW5c421ha19mUIuEu+cRFKceMx5 bD5tbFWphgW0C1kyk5VUd4L4jXvdAcx46a+Sf9SvXrDaOGKa2 X-Received: by 2002:a17:903:3810:b0:2d6:3c22:99bf with SMTP id d9443c01a7336-2db124afcefmr298686945ad.9.1788733558298; Sun, 06 Sep 2026 15:25:58 -0700 (PDT) X-Received: by 2002:a17:903:3810:b0:2d6:3c22:99bf with SMTP id d9443c01a7336-2db124afcefmr298686525ad.9.1788733557733; Sun, 06 Sep 2026 15:25:57 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: Pierrick Bouvier , peter.maydell@linaro.org, Brian Cain Subject: [PATCH 3/3] target/hexagon: Fix semihosting ACCESS filename handling Date: Sun, 6 Sep 2026 15:25:51 -0700 Message-Id: <20260906222551.3712954-4-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260906222551.3712954-1-brian.cain@oss.qualcomm.com> References: <20260906222551.3712954-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: pXitD1LeQYuxleUzlbUJqIx3LIVQi4bu X-Proofpoint-ORIG-GUID: pXitD1LeQYuxleUzlbUJqIx3LIVQi4bu X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA2MDI1MCBTYWx0ZWRfX/cBDkWkDMD7D /cae1WtCR9dXGerlYTk+it09HMxiOisTLiWzS9JrrT+n0OOoXXC8oCqgV+OZCU/yUD77t0YD9Dh jwCI6ooToIH5AefxRheQkhj/DOhmfshRSPFpkHlcKq2gXlZkGcmK151LbpmScxk2Lbf0z0FQC5d hN/Qpwe24AeTeBeHXS60xUlSpJJLf8gVo7oIralVk598NmGoF8+kVzSyLkku65LGPrzGzZGLzr6 mSV0+9cvUZHCLOyaEpKC9UpKIJA3+ozEiyOxQkl+K7ZZ3D0wVpKoDwn4CbqvPM6FudddQk3P+/C X2CIyQpIvvqm64ZSpoVJc0dZYjSJfnrh3Z52IF5HxyKiwsryRXM93NPDQ1Llqb4GSxMCNImosMp CMidZtKS60D8zer7MRdTiu5gnStWu6EsQ27Y6IBSBm7komIg07Ryd9O3OZLK+IPBMvfHHMlKB9N 7E3ShNQDQWVjGkcUB8A== X-Authority-Analysis: v=2.4 cv=DYgnbPtW c=1 sm=1 tr=0 ts=6a9de876 cx=c_pps a=JL+w9abYAAE89/QcEU+0QA==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=VdqzKS8jKosA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=DJpcGTmdVt4CTyJn9g5Z:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=pS50CBgNNeok3lFgILkA:9 a=QEXdDO2ut3YA:10 a=324X-CrmTo6CU4MGRt3R:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA2MDI1MCBTYWx0ZWRfX11uGm/FSDcBt TO3xPJtcBVXXrdMx5EDAVsZ98epujeTApQneb3c8Ad6t76rm9FGMGXjr4qeMUG9pUYgDSii1NvV nv+dYCdBJhVlrSS65432sjoMj/ihWxM= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-06_03,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 clxscore=1015 bulkscore=0 suspectscore=0 malwarescore=0 adultscore=0 lowpriorityscore=0 priorityscore=1501 impostorscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2609060250 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.168.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0a-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1788733624106158500 HEX_SYS_ACCESS wrote a NUL byte past its fixed-size filename buffer when the guest string filled it. Use lock_user_string() to avoid the out-of-bounds w= rite. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Resolves: Coverity CID 1685942 Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Signed-off-by: Brian Cain Reviewed-by: Peter Maydell --- target/hexagon/hexswi.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index 18d73b491a0..1c690cf3789 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -603,25 +603,24 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 case HEX_SYS_ACCESS: { - char filename[BUFSIZ]; + char *filename; uint32_t FileNameAddr; uint32_t BufferMode; - int rc; - - int i =3D 0; + int rc, err; =20 hexagon_read_memory(env, swi_info, 4, &FileNameAddr, retaddr); - do { - hexagon_read_memory(env, FileNameAddr + i, 1, &filename[i], - retaddr); - i++; - } while ((i < BUFSIZ) && (filename[i - 1])); - filename[i] =3D 0; + filename =3D lock_user_string(FileNameAddr); + if (!filename) { + semi_cb(cs, -1, EFAULT); + break; + } =20 hexagon_read_memory(env, swi_info + 4, 4, &BufferMode, retaddr); =20 rc =3D access(filename, BufferMode); - semi_cb(cs, rc, rc =3D=3D 0 ? 0 : errno); + err =3D errno; + unlock_user(filename, FileNameAddr, 0); + semi_cb(cs, rc, rc =3D=3D 0 ? 0 : err); } break; =20 --=20 2.34.1