From nobody Fri Oct 23 15:09:48 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1792461901; cv=none; d=zohomail.com; s=zohoarc; b=Zh8D0J3QqXsIO7UFYkzOSAOFuJpg/Nj2iZh8CVz0mGIWhaStp+oNr4X1ssYLElX4Ci46BU7HRt11McB7QbovsLWmtsLOxiRumlwZRZibhmXaejAwjIuvldlysOK+FvhYK7FK+1oLSE4WVeEphuzZHsXuOFLdBNuD85Otl0+8xII= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792461901; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=S2MeHMpz8BmqywjJk1EdmKFe8fPBaFFfeBEyubIomFg=; b=g0WeUy3yfWmRDz+th5cz6FqsBKP4+Ga8hZX4r2gaM9zpKTW3tsnUcEJcAMobBggQMx2nVyNvGq5U0Q/SPBtFlgjt6pYxFaVSQAoOWuWhOpmuy2GlcbZE5kaBw6Cn7NkMacYSutVl602gxm5BShTon0GnbcEe3ueCoQGJX5FKIAA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792461901541977.4073555541713; Mon, 19 Oct 2026 19:05:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIzCr-00011Z-MW; Mon, 19 Oct 2026 22:04:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIzCp-00010l-3Q for qemu-devel@nongnu.org; Mon, 19 Oct 2026 22:03:59 -0400 Received: from mx0b-0031df01.pphosted.com ([205.220.180.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIzCi-0003ij-Jl for qemu-devel@nongnu.org; Mon, 19 Oct 2026 22:03:58 -0400 Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69K0tH4m706788 for ; Tue, 20 Oct 2026 02:03:50 GMT Received: from mail-dy1-f200.google.com (mail-dy1-f200.google.com [74.125.82.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4hdw5pgfcx-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 20 Oct 2026 02:03:49 +0000 (GMT) Received: by mail-dy1-f200.google.com with SMTP id 5a478bee46e88-341eff9e381so8019723eec.1 for ; Mon, 19 Oct 2026 19:03:49 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1831a6f58c2sm49452078c88.11.2026.10.19.19.03.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Oct 2026 19:03:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= S2MeHMpz8BmqywjJk1EdmKFe8fPBaFFfeBEyubIomFg=; b=MIAZXItUhYJNtuGh 6KyZAl8SmhccyFVPeFcohNlJ+pVJib0/lw+iDp1XO66NR9sBKSTcTUuKAqA/tEYm 4SCG5zzRnKfDQpffxzEwFzm3HTnjObpLZlUyVPvrSSi2A2IuMY3hCbHUFIN04TwR Es/LcjQh7ZEj6GD82uIJIEsKzUxRClvRgJ5o++5SqVSrLSyhkngroddfE3zYz59u Hq6U/ZU5ri6mmX/ca+ziU17W3bz/yVCP5mzFpJA8YctOh5SPUeqqdYs8f4gOVSoC YVzGcbn6B5o0t93lfmmAQECOThrYeWmz+yF1x0yQ7TLNvy/Y8q4dAikUsb6oVfid PXBbew== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1792461829; x=1793066629; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=S2MeHMpz8BmqywjJk1EdmKFe8fPBaFFfeBEyubIomFg=; b=YwfTBhwtQNftJe36/3ZP+sKCeoL0k/81sT1qOxXT3P2aRQmxtVT/Npy+urBiDtoOXc qQFYyfnN5bT3P+ket8+SOjPYybXcVQ6wiwDniUCQJZbNYX9LH2CpqxLpva4CDZGO267M aaD+1EUsj8PeC7nLn5TCgMX+f+fdUb2fCrieGxQURJ3Bre42lRQbVxwjnpht4NjSccXT EuISldmtLD0AwGRiyRV2PyKtGp/ttpvn7fPWHcw4EUZSylvmqZnJsquuubT7SF7EJ9M9 oaJCZIovm1uctxvQ7RV/6cO7EGeMWbBTSTAi/oS2DRVE+ey4L1idIdpOdCxvr+UJwq2u yxRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792461829; x=1793066629; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=S2MeHMpz8BmqywjJk1EdmKFe8fPBaFFfeBEyubIomFg=; b=EQqhOx8E1jGwF/ukjB+0syRtGSnnmICI3cEvVPLChKeX2pBspHjdplBwFsWmk5HH4E BgXs+gsRntwzVbXvI0wSiBwHRL5ANIrGC27OGGqwCr8QalfhU/Rtw78vfzwb5sy6bEwA E6L3D9gYBbbntWLWxHPIVHErt9EP8mq2VscS/lCI/E6PPqDJDkSFypFmO5z3V0IMGYRs J65Kqd5sjPmMJeaSWUC9CqB9+R+nj9hgDH5Y8Ci5dXe7nRZK+ugHgNE0DY6SzLLatZjz R7y3UGCyEdIWFW1v/CcmcRxQV+5wdHq4KU6/Q2qV9b7a8OyRWVz1ZssbNxvXm0gztlLb Cn/g== X-Gm-Message-State: AFq9FYI9CKGXYUX3/zAi0KNE9Cj519w4xg7vK497muKlZyDIYzs2vnU4 LagDwA5q2DJ7K3fzoVJLbNxp8vmgmMZfvXFNscET/hBejJPW0IIW2tkoyAk8uU4wsPIen6SHXOH nd9Qhqqu9gUc88WzPaTv2yhft8SWY30gpb3xo2ZfaZynd0C4Gz6mxdFpH1IxtvUhKFw== X-Gm-Gg: AYBFou3XUqN5j0lRDzWGs4ngBfSRlEUJXSC5BYoEOD5gJsExAaqpKY8lYR25HpseYW9 iI1MBmkqVXAhwdOtLcCUWbEe+qYPEGbqKgaaFo4188yo0r31Em7Exqbxhy7xVaz9gORJm/gm4tk lbQDVgdRzXdOD3JQ/EOtzpjJSRHacn6qectd8UQ4laZ8h0RU+bvdxYa7YUOovKqTit+TcRhgIw9 KxjB4Z1dZACQ+SieXt2363CC9G2mtSSUpirdd2jbM/chZWgmAVYpJXF0dwRQtB+PQpuhdq9yfgA Dq+PR5VgGjIEnG78MTCEgDok7rIzd67jC6/PblHzWFGElFifcaHIQzYTM8Fdhj0LwRaJJaAZ1GV FbbJImnXCbvJH4lCz6/9O7zMSNs0S7akoT6vEEropiM0aYLfa X-Received: by 2002:a05:7022:ea81:20b0:13e:6efa:78f7 with SMTP id a92af1059eb24-18511eb69cfmr12278451c88.15.1792461828806; Mon, 19 Oct 2026 19:03:48 -0700 (PDT) X-Received: by 2002:a05:7022:ea81:20b0:13e:6efa:78f7 with SMTP id a92af1059eb24-18511eb69cfmr12278415c88.15.1792461828067; Mon, 19 Oct 2026 19:03:48 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: philmd@oss.qualcomm.com, peter.maydell@linaro.org, Brian Cain , Pierrick Bouvier Subject: [PATCH v5 1/4] target/hexagon: use get_user*() for semihosting arguments Date: Mon, 19 Oct 2026 19:03:39 -0700 Message-Id: <20261020020342.3619566-2-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261020020342.3619566-1-brian.cain@oss.qualcomm.com> References: <20261020020342.3619566-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Authority-Analysis: v=2.4 cv=a7WlZkSF c=1 sm=1 tr=0 ts=6ad6cc06 cx=c_pps a=PfFC4Oe2JQzmKTvty2cRDw==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=OHM9QerqK7XzSgDXoFkA:9 a=QEXdDO2ut3YA:10 a=6Ab_bkdmUrQuMsNx7PHu:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-ORIG-GUID: ATCnYZCCx7Luzwf3ZYHo12PGH0xtI6tk X-Proofpoint-GUID: ATCnYZCCx7Luzwf3ZYHo12PGH0xtI6tk X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDIwMDAwNyBTYWx0ZWRfX30T3jeT9X2rX mzb1ftOSIQ2lvMmGnpTkL/zDhmdPoPEQwnxicr/Ywv1X4zJXwo1kE6UzaZq6nqMx2QhI8tbsw9v E5cV6YkWG7Z2TSUivwfKG7//+2utvqhd2xriIo4YXed6fCEmFhgnzgo8yNFxO3Bc3htkwtSPjC8 7N61IieKTilt2tp0ozrGbe2CLnsHIVw4P5e3TwNHomJzrIYKfIo07Nu4HGh/Mu+I8ADUV7sQell HaG78k4rAf+n+Zg5RZiYeY9H+fLrsKmlHxiQmJp2hZ8tdHO6RWjDOB07PqussAMI34UB3ThkLnt ilvFU4SQ3jJZDYGECLyXYgNR7skyd25Q6bOtzoAG9dPk2TZsmc9F1QFQpmlsmsCSXBzPn/LEHMi RT841i/MeBf91oiKd5I4cHeMUIjy91AvfyhIrNGhEBZNfNWdnymYl4xE1s28t//3KJ/x0igdb7w iFrWXxu5FX4HfKfPSMw== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDIwMDAwNyBTYWx0ZWRfXz2VjqvjyOF3f Jry/1A47C3RZw8slAgUEYETUJ5J9JSvE4WY0J2m+fy+Txctd66cZp2UeDtL9mh7pv+VGBuKEf/y ZsWrXTWpOvB5D+tlLcf20klmock3V0k= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-20_01,2026-10-19_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 phishscore=0 lowpriorityscore=0 bulkscore=0 clxscore=1015 malwarescore=0 priorityscore=1501 adultscore=0 suspectscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610190000 definitions=main-2610200007 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.180.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0b-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1792461903289158500 Link: https://lore.kernel.org/qemu-devel/CAFEAcA9EL10xpPx_0YD-q6YcWWP9-iwcy= G8x0s1yQhKB-XQGXQ@mail.gmail.com/ Suggested-by: Peter Maydell Reviewed-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/cpu_helper.h | 2 - target/hexagon/cpu_helper.c | 48 ++------------------ target/hexagon/hexswi.c | 89 ++++++++++++++++++++++++------------- 3 files changed, 63 insertions(+), 76 deletions(-) diff --git a/target/hexagon/cpu_helper.h b/target/hexagon/cpu_helper.h index 8b1fb98a51a..b261b9177bc 100644 --- a/target/hexagon/cpu_helper.h +++ b/target/hexagon/cpu_helper.h @@ -7,8 +7,6 @@ #ifndef HEXAGON_CPU_HELPER_H #define HEXAGON_CPU_HELPER_H =20 -void hexagon_read_memory(CPUHexagonState *env, target_ulong vaddr, int siz= e, - void *retptr, uintptr_t retaddr); void hexagon_write_memory(CPUHexagonState *env, target_ulong vaddr, int size, uint64_t data, uintptr_t retaddr); void hexagon_peek_memory_range(CPUHexagonState *env, uint32_t start_addr, diff --git a/target/hexagon/cpu_helper.c b/target/hexagon/cpu_helper.c index 6dc06401ad5..c66ad88108d 100644 --- a/target/hexagon/cpu_helper.c +++ b/target/hexagon/cpu_helper.c @@ -28,48 +28,6 @@ =20 #ifndef CONFIG_USER_ONLY =20 -static bool hexagon_read_memory_small(CPUHexagonState *env, target_ulong a= ddr, - int byte_count, uint64_t *data, - int mmu_idx, uintptr_t retaddr) - { - /* handle small sizes */ - switch (byte_count) { - case 1: - *data =3D cpu_ldub_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - case 2: - *data =3D cpu_lduw_le_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - case 4: - *data =3D cpu_ldl_le_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - case 8: - *data =3D cpu_ldq_le_mmuidx_ra(env, addr, mmu_idx, retaddr); - return true; - - default: - /* larger request, handle elsewhere */ - return false; - } -} - -void hexagon_read_memory(CPUHexagonState *env, target_ulong vaddr, int siz= e, - void *retptr, uintptr_t retaddr) -{ - BQL_LOCK_GUARD(); - CPUState *cs =3D env_cpu(env); - unsigned mmu_idx =3D cpu_mmu_index(cs, false); - uint64_t data; - if (hexagon_read_memory_small(env, vaddr, size, &data, mmu_idx, retadd= r)) { - stn_he_p(retptr, size, data); - } else { - cpu_abort(cs, "%s: ERROR: bad size =3D %d!\n", __func__, size); - } -} - static bool hexagon_write_memory_small(CPUHexagonState *env, target_ulong = addr, int byte_count, uint64_t data, int mmu_idx, uintptr_t retaddr) @@ -117,11 +75,13 @@ static inline uint32_t page_start(uint32_t addr) void hexagon_peek_memory_range(CPUHexagonState *env, uint32_t start_addr, uint32_t length, uintptr_t retaddr) { - unsigned int warm; + CPUState *cs =3D env_cpu(env); + unsigned int mmu_idx =3D cpu_mmu_index(cs, false); uint32_t first =3D page_start(start_addr); uint32_t last =3D page_start(start_addr + length - 1); + for (uint32_t page =3D first; page <=3D last; page +=3D TARGET_PAGE_SI= ZE) { - hexagon_read_memory(env, page, 1, &warm, retaddr); + cpu_ldub_mmuidx_ra(env, page, mmu_idx, retaddr); } } =20 diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index e7362b56650..a28f83515fb 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -28,6 +28,7 @@ #include "semihosting/console.h" #include "semihosting/syscalls.h" #include "semihosting/guestfd.h" +#include "semihosting/uaccess.h" #include "system/runstate.h" =20 /* non-arm-compatible semihosting calls */ @@ -168,14 +169,18 @@ static void init_semihosting_guestfds(void) } } =20 -static void do_preload(CPUHexagonState *env, target_ulong swi_info, bool l= oad) +static bool do_preload(CPUHexagonState *env, target_ulong swi_info) { + CPUState *cs =3D env_cpu(env); uint32_t addr, count; uintptr_t retaddr =3D 0; =20 - hexagon_read_memory(env, swi_info + 4, 4, &addr, retaddr); - hexagon_read_memory(env, swi_info + 8, 4, &count, retaddr); + if (get_user_u32(addr, swi_info + 4) || + get_user_u32(count, swi_info + 8)) { + return false; + } hexagon_peek_memory_range(env, addr, count, retaddr); + return true; } =20 /* Hexagon semihosting errno values */ @@ -429,7 +434,10 @@ static void sim_handle_trap0(CPUHexagonState *env) * the input address. The contents of that buffer will be * directed to the SWI interface. */ - do_preload(env, swi_info, (what_swi =3D=3D HEX_SYS_WRITE)); + if (!do_preload(env, swi_info)) { + semi_cb(cs, -1, EFAULT); + return; + } } /* * ARM-compat semihosting SWI numbers are all <=3D 0x31. @@ -464,26 +472,29 @@ static void sim_handle_trap0(CPUHexagonState *env) char filename[BUFSIZ]; target_ulong physical_filename_addr; unsigned int filemode; - int length; + uint32_t length; int real_openmode; int ret, err =3D 0; int i =3D 0; =20 - hexagon_read_memory(env, swi_info, 4, &physical_filename_addr, ret= addr); - hexagon_read_memory(env, swi_info + 4, 4, &filemode, retaddr); - hexagon_read_memory(env, swi_info + 8, 4, &length, retaddr); + if (get_user_u32(physical_filename_addr, swi_info) || + get_user_u32(filemode, swi_info + 4) || + get_user_u32(length, swi_info + 8)) { + goto do_fault; + } =20 if (length >=3D BUFSIZ) { qemu_log_mask(LOG_GUEST_ERROR, - "%s: filename too large (%d)\n", + "%s: filename too large (%" PRIu32 ")\n", __func__, length); semi_cb(cs, -1, ENAMETOOLONG); break; } =20 do { - hexagon_read_memory(env, physical_filename_addr + i, 1, - &filename[i], retaddr); + if (get_user_u8(filename[i], physical_filename_addr + i)) { + goto do_fault; + } i++; } while (filename[i - 1]); =20 @@ -531,7 +542,9 @@ static void sim_handle_trap0(CPUHexagonState *env) case HEX_SYS_ISTTY: { int fd; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); + if (get_user_u32(fd, swi_info)) { + goto do_fault; + } semi_cb(cs, isatty(fd), 0); } break; @@ -540,8 +553,10 @@ static void sim_handle_trap0(CPUHexagonState *env) { int fd; target_ulong off; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); - hexagon_read_memory(env, swi_info + 4, 4, &off, retaddr); + if (get_user_u32(fd, swi_info) || + get_user_u32(off, swi_info + 4)) { + goto do_fault; + } semihost_sys_lseek(env_cpu(env), common_semi_ftell_cb, fd, off, GDB_SEEK_SET); } @@ -556,13 +571,17 @@ static void sim_handle_trap0(CPUHexagonState *env) char filename[BUFSIZ]; target_ulong physical_filename_addr; target_ulong statBufferAddr; - hexagon_read_memory(env, swi_info, 4, &physical_filename_addr, ret= addr); + if (get_user_u32(physical_filename_addr, swi_info) || + get_user_u32(statBufferAddr, swi_info + 4)) { + goto do_fault; + } =20 if (what_swi =3D=3D HEX_SYS_STAT) { int i =3D 0; do { - hexagon_read_memory(env, physical_filename_addr + i, 1, - &filename[i], retaddr); + if (get_user_u8(filename[i], physical_filename_addr + i)) { + goto do_fault; + } i++; } while ((i < BUFSIZ) && filename[i - 1]); rc =3D stat(filename, &st_buf); @@ -590,8 +609,6 @@ static void sim_handle_trap0(CPUHexagonState *env) sys_stat.mtime =3D cpu_to_le32(st_buf.st_mtime); sys_stat.ctime =3D cpu_to_le32(st_buf.st_ctime); } - hexagon_read_memory(env, swi_info + 4, 4, &statBufferAddr, retaddr= ); - for (int i =3D 0; i < sizeof(sys_stat); i++) { hexagon_write_memory(env, statBufferAddr + i, 1, st_bufptr[i], retaddr); @@ -604,8 +621,10 @@ static void sim_handle_trap0(CPUHexagonState *env) { int fd; off_t size_limit; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); - hexagon_read_memory(env, swi_info + 4, 8, &size_limit, retaddr); + if (get_user_u32(fd, swi_info) || + get_user_u64(size_limit, swi_info + 4)) { + goto do_fault; + } semihost_sys_ftruncate(cs, semi_cb, fd, size_limit); } break; @@ -619,16 +638,17 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 int i =3D 0; =20 - hexagon_read_memory(env, swi_info, 4, &FileNameAddr, retaddr); + if (get_user_u32(FileNameAddr, swi_info) || + get_user_u32(BufferMode, swi_info + 4)) { + goto do_fault; + } do { - hexagon_read_memory(env, FileNameAddr + i, 1, &filename[i], - retaddr); + if (get_user_u8(filename[i], FileNameAddr + i)) { + goto do_fault; + } i++; } while ((i < BUFSIZ) && (filename[i - 1])); filename[i] =3D 0; - - hexagon_read_memory(env, swi_info + 4, 4, &BufferMode, retaddr); - rc =3D access(filename, BufferMode); semi_cb(cs, rc, rc =3D=3D 0 ? 0 : errno); } @@ -641,8 +661,10 @@ static void sim_handle_trap0(CPUHexagonState *env) uint32_t BufferSize; uint32_t rc =3D 0, err =3D 0; =20 - hexagon_read_memory(env, swi_info, 4, &BufferAddr, retaddr); - hexagon_read_memory(env, swi_info + 4, 4, &BufferSize, retaddr); + if (get_user_u32(BufferAddr, swi_info) || + get_user_u32(BufferSize, swi_info + 4)) { + goto do_fault; + } =20 if (!getcwd(cwdPtr, PATH_MAX)) { err =3D errno; @@ -676,7 +698,9 @@ static void sim_handle_trap0(CPUHexagonState *env) case HEX_SYS_FTELL: { int fd; - hexagon_read_memory(env, swi_info, 4, &fd, retaddr); + if (get_user_u32(fd, swi_info)) { + goto do_fault; + } semihost_sys_lseek(cs, common_semi_ftell_cb, fd, 0, GDB_SEEK_CUR); } break; @@ -720,6 +744,11 @@ static void sim_handle_trap0(CPUHexagonState *env) "unknown swi request: 0x%" PRIx32 "\n", (uint32_t)what_swi); semi_cb(cs, -1, ENOSYS); + break; + + do_fault: + semi_cb(cs, -1, EFAULT); + break; } } =20 --=20 2.34.1 From nobody Fri Oct 23 15:09:48 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1792461901; cv=none; d=zohomail.com; s=zohoarc; b=HZj20gyvpf5DKYCh7d46F3m9AWY1cGFb7wWf1GlgveyVaMpryBlZt3YsgoNyrhlpXhc9croNmpcNHXicu2DzIWkFv1ZrdQoA1+epP/FxIkLaCqVLxVpOZafHlVINCUCa4yGywaDgyXwnHsEPQp/+i7bteK4HEQNwnjG643+7OeU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792461901; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=TmGsq01z4wi/rE4LEFDSrdwepUkWj7C4ncGwvjAmEP4=; b=bVHAz7M6KBdra8kQ7SJ29cbC6JvZkG3QhSCDz9qWjdUmOvVhw0tXkOFlF1sqBFgO+C8s+cBCez+o5l+M8iM0k4RM4aRCvocWz22O1X9Ortahqjj/zkMAzYtlzyV9/vXsvNmX7+sIvEdvEwnmOLuqXvWuhzV8XaH7xudSJrmu/uQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792461901702674.4075860598025; Mon, 19 Oct 2026 19:05:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIzCn-000109-PT; Mon, 19 Oct 2026 22:03:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIzCm-0000zy-Jo for qemu-devel@nongnu.org; Mon, 19 Oct 2026 22:03:56 -0400 Received: from mx0a-0031df01.pphosted.com ([205.220.168.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIzCk-0003iv-Ef for qemu-devel@nongnu.org; Mon, 19 Oct 2026 22:03:56 -0400 Received: from pps.filterd (m0279867.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69K0tW5D1255247 for ; Tue, 20 Oct 2026 02:03:52 GMT Received: from mail-dy1-f198.google.com (mail-dy1-f198.google.com [74.125.82.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4hdw5n8cm4-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 20 Oct 2026 02:03:52 +0000 (GMT) Received: by mail-dy1-f198.google.com with SMTP id 5a478bee46e88-3510d0baf63so6872898eec.1 for ; Mon, 19 Oct 2026 19:03:51 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1831a6f58c2sm49452078c88.11.2026.10.19.19.03.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Oct 2026 19:03:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= TmGsq01z4wi/rE4LEFDSrdwepUkWj7C4ncGwvjAmEP4=; b=anWGBupBeftlqDl+ lBWIVszUg8ObHNe1PvG1EQ8xiVHHD00YpijSBx4SCyBRiS+afCCzeZq8OkasVE2X zaeCeo+WCOZ0kEfduV8xIsh2VxohjJnZ94ENMgvjrlZMZytQOnTLrullLc7jXe3H fId5vADfZyGGCH3vOv+c/hLZ1y4PRRGHue24sZvpB0iYBBhrac5snry6p8Zkgoo/ +DNPh9VyqTYxplA1xHLcNg1hmlykv1pfww1xIq9VKZp2iyMxwZnk59xh0oVzZBGG huuPpa7pt2ymzAGhW3n77/THiu9goWCD7Cw6QfsCXweT+nz5IrICJms/6tQEX0Wj R7lNpw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1792461831; x=1793066631; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=TmGsq01z4wi/rE4LEFDSrdwepUkWj7C4ncGwvjAmEP4=; b=alTMd6yXPSiWWf47oGdbarZ3x079m3ABOSz85ruBSIuHUQCQ2pHxXLmdwmCjXvIThn 1V78tnO2k7NnpdY3XOdmn3l8y73SiyhpRqB+OnrCfY57fMgCxo42yuVMQl+pZZIO8H5u LAc36VbfSizqamD+ZXvNv0Ej1mgTDKUAwlJ01FFs5inxM/DreYJ5TypzXB3RDTH6p45f DXi3Qt5znfVrKQ+Zoo9zqRsfMONdIvriOEQv1OIZiJ+Fvjw6V52BUCMO5aUAgV3GkBNp 9Jttzi1QtoPbGCiNGOTU+KD/cbedX3EmeLmw/p8VxlInwoHAMZeXuaxyn7GjEEYHQWqL ZTCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792461831; x=1793066631; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=TmGsq01z4wi/rE4LEFDSrdwepUkWj7C4ncGwvjAmEP4=; b=nXqGFZYpuRop6UdT3u0+OZEsXNjXV/2FPOjWVgYV/+6u+UIBeCGuhp1NLyfqi9xKOv aL3UQpSYh750MR6kWAywQlKtG7m+tokeB7etE5wpKk+UYu5te4vCnjPqqEwknaldPOgH b1qSwALVKzsFwWgbi2KCZWCLF8UuutqcQVLRRQdLGPi3di6fQcxdWpZ7a0wtv8Sv2S9N RS2G23q96bZjEnxxGZWQHWBSs4qk6sAJIXuy+vCLug+snESBjmwbJ0i21psdJbJ2C9Aw iLf+XkjrQEM8OP0l1YmhP0ogUSHXAsLzWZUTVrtPP9NPXjK7wGhRXxBToTT5e57Pqucm eeWA== X-Gm-Message-State: AFq9FYKxVn4UQmTLeRHO3jdkfg1eTNb4Z3km3QHibfWD4klVrfeYxCLC mO/2SzRzhBdVOEab0GXTn/0APiz3Ag7yvxCEJApFOYfN/xpa4qGYyUg9XZ9FLEwoxKpx3KYrup2 8+VzXX4nrggx7B52bt2s3N7hR9AF0nF7Ox8Yq7PKU4lNn+LIkHC5JhsMawoS7Hkj4Ng== X-Gm-Gg: AYBFou2VKIMC8GFv1ul2nR9Z8zEnIsKGQl4XPs/kjD6CbnGjbC3G9+/YtN9M3lwIVrW kqRLG0HZlSLScRK1IGoAQA3TG9FAgY4RebWDGrOflRbJ7qcM4WZ5ZMHmVWfr0xtw/a/3DDe3IFZ Y/3Tmp5ExzoOvoRFRhxMEf8zXFZG2J/J6JiW2f0uP1oViHx2FjJz7CycuGdzi4dKqhbG7H1txWw DRwjkFsi2VLJwRw0qViLKF3lMvFXIvNWNHeTRrOqa21CDmUeZxGh7U0f2Lqxl360lWYA52rSsGA LzZU9WLi2NYwH84A1O9WzU79FxWFFIQ1ZcGyMmlkPqVv1HPhP8tMMOBHUdECUnxK18Ue5g7XAX+ M8uB0BDcmo31X1w0pcD2RIE+xqy+OD95LcwJi0KsoPttpvapG X-Received: by 2002:a05:7022:150e:b0:141:b2c3:d84e with SMTP id a92af1059eb24-185120a8bb4mr15651524c88.11.1792461831088; Mon, 19 Oct 2026 19:03:51 -0700 (PDT) X-Received: by 2002:a05:7022:150e:b0:141:b2c3:d84e with SMTP id a92af1059eb24-185120a8bb4mr15651502c88.11.1792461830562; Mon, 19 Oct 2026 19:03:50 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: philmd@oss.qualcomm.com, peter.maydell@linaro.org, Brian Cain , Pierrick Bouvier Subject: [PATCH v5 2/4] target/hexagon: fix semihosting OPEN filename handling Date: Mon, 19 Oct 2026 19:03:40 -0700 Message-Id: <20261020020342.3619566-3-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261020020342.3619566-1-brian.cain@oss.qualcomm.com> References: <20261020020342.3619566-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-ORIG-GUID: h_b0_gUcRTKJ_pVN9u7K7S3lVNVdCfR1 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDIwMDAwNyBTYWx0ZWRfX4bsTNDQ8hVP8 ANr79f4e5i0k6+P+dibBQJ2ba6b1qlCMpwxnsFNki9juUUokaC0SMLgJAzTxW8ZSbLqlCFHhKxB SPB29WUFeOm3UJVjHxAscgMsBOLpbedyLBTQa0aVgldNZuvNsXZJrx84at1bM0F8h303Qh5DqgL KlDvD+XOl4cTD2VyIBMY/YL3p3MBlmsf5n5sT7IyPjewmE9uK73e7BIoyAowweKw5+HTghvAlmo pZM6kNrQOa1W7B73aLyFD6CT8jBn07+wza/EgT5I+pcj3mNS/FkXg+a9qq2wqUJGjHy2BUnmPLa Mwohmq+TtZXW8IOQKy2bYb1PM1MZSYxafJjQQOSCccNoMQvPATaKtpHsl1RI8f0TJWM4uX4gya2 mLiDw9M4EjT9nGtTGH+Tk3rv1kQoXM9ZUpBEHht9narT282CvO+wFpKflXQ4U81VNZDtB17Bfb5 Ub8VZtNrArqqZ4OourQ== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDIwMDAwNyBTYWx0ZWRfX6aiBufhanR3Y 315vJea3L+g8eVih7+JcHsn8xrEOY1W0WIwXlxQzn1/GzEjRrGP9r3MXJQPKfFCbHo12YnA95A4 +yMtXiEuxVGHN9uInfecS+z6agArLmU= X-Authority-Analysis: v=2.4 cv=VI9IDNPX c=1 sm=1 tr=0 ts=6ad6cc08 cx=c_pps a=wEP8DlPgTf/vqF+yE6f9lg==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=eoimf2acIAo5FJnRuUoq:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=wfIhpZVs-6LWPqknoVUA:9 a=QEXdDO2ut3YA:10 a=bBxd6f-gb0O0v-kibOvt:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-GUID: h_b0_gUcRTKJ_pVN9u7K7S3lVNVdCfR1 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-20_01,2026-10-19_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 phishscore=0 adultscore=0 lowpriorityscore=0 spamscore=0 malwarescore=0 clxscore=1015 priorityscore=1501 bulkscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610190000 definitions=main-2610200007 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.168.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0a-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1792461905167158500 HEX_SYS_OPEN copied guest bytes into a fixed-size buffer until it found a NUL. A missing terminator could overrun that buffer. Use lock_user() with the ABI filename length and validate its terminating NUL before opening it. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Reviewed-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/hexswi.c | 30 +++++++++++++----------------- 1 file changed, 13 insertions(+), 17 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index a28f83515fb..cc48c9ba9f1 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -469,35 +469,29 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 case HEX_SYS_OPEN: { - char filename[BUFSIZ]; + char *filename; target_ulong physical_filename_addr; unsigned int filemode; - uint32_t length; + uint32_t filename_len; + size_t filename_size; int real_openmode; int ret, err =3D 0; - int i =3D 0; =20 if (get_user_u32(physical_filename_addr, swi_info) || get_user_u32(filemode, swi_info + 4) || - get_user_u32(length, swi_info + 8)) { + get_user_u32(filename_len, swi_info + 8)) { goto do_fault; } =20 - if (length >=3D BUFSIZ) { - qemu_log_mask(LOG_GUEST_ERROR, - "%s: filename too large (%" PRIu32 ")\n", - __func__, length); - semi_cb(cs, -1, ENAMETOOLONG); - break; + /* The ABI length excludes the filename's terminating NUL. */ + filename_size =3D (size_t)filename_len + 1; + filename =3D lock_user(VERIFY_READ, physical_filename_addr, + filename_size, true); + if (!filename || filename[filename_len] !=3D '\0') { + unlock_user(filename, physical_filename_addr, 0); + goto do_fault; } =20 - do { - if (get_user_u8(filename[i], physical_filename_addr + i)) { - goto do_fault; - } - i++; - } while (filename[i - 1]); - /* convert ARM ANGEL filemode into host filemode */ if (filemode < ARRAY_SIZE(angel_to_host_filemode_table)) { real_openmode =3D angel_to_host_filemode_table[filemode]; @@ -505,6 +499,7 @@ static void sim_handle_trap0(CPUHexagonState *env) qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid OPEN mode: %u\n", __func__, filemode); + unlock_user(filename, physical_filename_addr, 0); semi_cb(cs, -1, EINVAL); break; } @@ -524,6 +519,7 @@ static void sim_handle_trap0(CPUHexagonState *env) ret =3D guestfd; } } + unlock_user(filename, physical_filename_addr, 0); semi_cb(cs, ret, err); } break; --=20 2.34.1 From nobody Fri Oct 23 15:09:48 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1792461905; cv=none; d=zohomail.com; s=zohoarc; b=Kkd+DjBXgrVQGks0n3o92kecs1MPrRVI5owClum7YWriF0L7hN/TtpBJH1UbsXb8VF3vup69GpGW2JWlOTiwkYZZ7Q3DSmpt4yN+ykZhVygjkoHWJIB9KdXo80h5/xhdkLSpQi+V9k8hAlD69zhkBCs87P2jHjOTFmN9OG8ZZzM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792461905; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Enf2W/dFQxa7P2tBTeMCV59yWp+gzwwLwHLrsTYW8WY=; b=m15Qm+24sgW2tdM9w9qL5e8LKKOgqCkl7VXokxwR0RNCn5CHzzK+9d8R5bWTXgAuIGYEpjfmPqamMDW6eKTSDNJ57qI1f+RrMvVQAgDR43txMywWI4z20MDhTojSzL7xgeLffx2hldznJD4SJqaVn/Klq8inHMnz+NRfbcNZ1JA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792461905257284.6597720076095; Mon, 19 Oct 2026 19:05:05 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIzCq-00010y-2V; Mon, 19 Oct 2026 22:04:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIzCn-00010I-TA for qemu-devel@nongnu.org; Mon, 19 Oct 2026 22:03:58 -0400 Received: from mx0b-0031df01.pphosted.com ([205.220.180.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIzCk-0003iy-Vq for qemu-devel@nongnu.org; Mon, 19 Oct 2026 22:03:57 -0400 Received: from pps.filterd (m0279873.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69K0tKvp4178129 for ; Tue, 20 Oct 2026 02:03:53 GMT Received: from mail-dl1-f69.google.com (mail-dl1-f69.google.com [74.125.82.69]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4hdw5n0cgn-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 20 Oct 2026 02:03:53 +0000 (GMT) Received: by mail-dl1-f69.google.com with SMTP id a92af1059eb24-154e9d2d94fso4370535c88.0 for ; Mon, 19 Oct 2026 19:03:53 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1831a6f58c2sm49452078c88.11.2026.10.19.19.03.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Oct 2026 19:03:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= Enf2W/dFQxa7P2tBTeMCV59yWp+gzwwLwHLrsTYW8WY=; b=i+GpKD7qN0XM/YPM A1ymdyFBXWPTXqmw/Z4ehotLnDW8vKdXQHVALxzZBHwsMrNGh1WjIoSDdxmaUicv N6bUFmx8jEhYmgVxKc+Az+RUcTT5plqg2qtV7Nbte8onizfudrHobC6r24gDoxbZ iYAUlrXbeKtgaJFEIDNDahSx9jYSnF06N9MifEXXygivvLmcp9n4jdBkZi6TMlTl W9tAAlnrknOdik1AyVUZtTALQ0yHUPP1prsckucfyXxkYsuVDOBMFUFA8RvjIONr Dxr8uj0d4ad1Uhi5BTcDtDacN1LzCc8N4M1YlBkN8vQbA14dGI5o3A8/ntaH4gK+ 90MbYg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1792461832; x=1793066632; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=Enf2W/dFQxa7P2tBTeMCV59yWp+gzwwLwHLrsTYW8WY=; b=izPkKiOL0lUeE7QXd6G3a2OiWJtbVWjypccogSCGyI82pyqYzltVeG6opiMuta2EG2 jaID5PTYUPwKT/xS4pD0O3MYlypnsSsDYdDIsgXzyeljIvCEFHpR2EyUceS8FdNUC7wD yJFUbVO7Y9OrPBuHEuaD3ZMpW6wJ3E8jPqShJRrTqvE4oqFNeU8V7FIPcDknxmkD+4Vy zwQccWzejRvnUDx7Zk79UWr/X+Kr55AZA8/XI/YbdkxzZ8aZcywPWo34+6cN7+ngy6So ky5uN69sb8ro9ZwUtBirW8oJWKFeOTv35cbvhQwk5XBxYV6wyzeorWmVNqhRcWamrmoH d5cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792461832; x=1793066632; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Enf2W/dFQxa7P2tBTeMCV59yWp+gzwwLwHLrsTYW8WY=; b=UqNeFlEL4ahjZhmAKemh11Pnwoxmnwvt00GUcqvlvUnL3zRKiuuIipG5r4yQxXJfBW pQmLTsQY0uIpdnsClOg+7YBmMVb+eW6Lcu1KCG4Mk6aKKjghW6za04JgpCIH4AsjoI8f 2LbUpjcyqR++wrxiTy53oq7gj6NicCR0Mr4q/Mc/ZsU73Ahtu6KbGs+QAUKD07qvaJhI B8NRt9Sa6TyF8nxYLJ9F09Gw3Gr73eek/QTY4JCEo3PVWTp6Li1T8JPbCDrwpipjLuKZ 8qxMn9JT9yBEloiE3i5kyPq1cPTM9/LIYJ6AIVvAAgQBPPHTYr9ro79eCiKWz4ULfHDn xTDQ== X-Gm-Message-State: AFq9FYK4D6+xq/Djhfk2vitNw8+skzlHsQ7YPkgwpO2s4yUBoVbsEVZp x28MzJNu3s+N5CtTlG8ae1/ebrrgcTfHb0lJSXZoTl29hUTk5ey1rmSajZh5SkP0FxyVqyeluXY PLGLOZs55LN/jsJrB0ovkMqJqfRnGFDGdJHYCI4579XSw5nMwGyd7cIfyvuiZUJ4WnA== X-Gm-Gg: AYBFou2HrGgrqO5d1gMU+vgqIBVT9RizrNSMrLdaS8ocRrpi35GwlVVkbYYDUbVGWHI TWNLTFn3UPcUHnQ82ZGEkE3gUHPQnIDKxoIFXCCYzTkf8De2ZlQemlvhb4NZYaws1n5GcApnaTo AN6ZAK4BL2bLPO01zD5tcdHa59weCKMg6QGXaD+wKNqWtiwKzYls/J7r0Fhl+elDCcguoiAFVl5 7TYsLBRDCMX6+2BHeSvpF/S0NUS/snqrpTyZR5XgVp6WvBl54uKPkuTgYg9daCbqv0mUdSfsVfd UeobO8XMWt1KSEpEBFAUckNKAYboOzIeFoagxAfb1OOiT0GAPAhd7KYbUBakI4KSlHFhVUOzxUy 3HpKb3MqhzGAu8vKw6bLs5+GqHofMCi/hrjN2By6+hNvA7oHT X-Received: by 2002:a05:701b:4305:b0:14d:baf5:c415 with SMTP id a92af1059eb24-1851238b618mr12737720c88.7.1792461832490; Mon, 19 Oct 2026 19:03:52 -0700 (PDT) X-Received: by 2002:a05:701b:4305:b0:14d:baf5:c415 with SMTP id a92af1059eb24-1851238b618mr12737696c88.7.1792461831929; Mon, 19 Oct 2026 19:03:51 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: philmd@oss.qualcomm.com, peter.maydell@linaro.org, Brian Cain , Pierrick Bouvier Subject: [PATCH v5 3/4] target/hexagon: fix semihosting STAT filename handling Date: Mon, 19 Oct 2026 19:03:41 -0700 Message-Id: <20261020020342.3619566-4-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261020020342.3619566-1-brian.cain@oss.qualcomm.com> References: <20261020020342.3619566-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: 6oUNqiKRKTYwfZ_sAGb9FrYnfztMuzFQ X-Proofpoint-ORIG-GUID: 6oUNqiKRKTYwfZ_sAGb9FrYnfztMuzFQ X-Authority-Analysis: v=2.4 cv=L7qI0OT8 c=1 sm=1 tr=0 ts=6ad6cc09 cx=c_pps a=kVLUcbK0zfr7ocalXnG1qA==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=rJkE3RaqiGZ5pbrm-msn:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=FZZFJ5KotruyPtQxbZcA:9 a=QEXdDO2ut3YA:10 a=vr4QvYf-bLy2KjpDp97w:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDIwMDAwNyBTYWx0ZWRfX5+DvT1Jm7k4k v035A60+31d0EjGUqDw8P2f4dj151J6nuuBmeQDQjJJPxgRbPfakksPkUBZUxeaBs6vDmhjYxNf nC8SojRg4OuYJGZR0fPb1VTX8BU4+Vps9ppotaanOsfDwist4V/zDC4fgdN7lPQ3njZ/6/sfMkV FxhpEJeKA3ZGjsMrxdqPbpFPuuDsBQ6dgRJiNEPbkuljL7i6drVddQkNJ5DwSA7M1qfauETg3Wl uKuELxZHQvKnkOEcWrYj6gC0YLLgShTfchdw+41xAKfo/S+DA6SnF1/qLu1pCxZ9w0cOsVopKwi Tt6fhgf7mUyHpisRHLgs9S0uih8GzPfpAVTfXSI9WPkJJch9VWIA32Kt0WEPs9/hihYynwCjT1X 0CQPx4KsQzFEWGFvD8Aasr0D0dwwzwedcpgDEJuzZil89vsGBbMWywVoDInHRza37xpIRw6LKvl xlz/GRp4tf4u7yINrlQ== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDIwMDAwNyBTYWx0ZWRfX62WAHP2LbjJS 888ptVtlVsetiDN4IkSAUOO4DkdKP9ugaUSF6mj1dfc2BR2k80psnPjkJSsDYnFdhbDYX02N/su oC+Zgaj55pulR5eiwqX+iRmHTRpyrgU= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-20_01,2026-10-19_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 adultscore=0 phishscore=0 priorityscore=1501 bulkscore=0 malwarescore=0 suspectscore=0 spamscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610190000 definitions=main-2610200007 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.180.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0b-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1792461907139158500 HEX_SYS_STAT could pass an unterminated local filename buffer to stat() when the guest string filled it. Use lock_user_string() to map the guest string safely. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Reviewed-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/hexswi.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index cc48c9ba9f1..a5c8ee27c7e 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -564,7 +564,7 @@ static void sim_handle_trap0(CPUHexagonState *env) struct stat st_buf; uint8_t *st_bufptr =3D (uint8_t *)&sys_stat; int rc, err =3D 0; - char filename[BUFSIZ]; + char *filename; target_ulong physical_filename_addr; target_ulong statBufferAddr; if (get_user_u32(physical_filename_addr, swi_info) || @@ -573,15 +573,14 @@ static void sim_handle_trap0(CPUHexagonState *env) } =20 if (what_swi =3D=3D HEX_SYS_STAT) { - int i =3D 0; - do { - if (get_user_u8(filename[i], physical_filename_addr + i)) { - goto do_fault; - } - i++; - } while ((i < BUFSIZ) && filename[i - 1]); + filename =3D lock_user_string(physical_filename_addr); + if (!filename) { + semi_cb(cs, -1, EFAULT); + break; + } rc =3D stat(filename, &st_buf); err =3D errno; + unlock_user(filename, physical_filename_addr, 0); } else { int fd =3D physical_filename_addr; GuestFD *gf =3D get_guestfd(fd); --=20 2.34.1 From nobody Fri Oct 23 15:09:48 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=oss.qualcomm.com ARC-Seal: i=1; a=rsa-sha256; t=1792461901; cv=none; d=zohomail.com; s=zohoarc; b=Ip7eYouOtXJW5P8Xa9FQ6r50t+/wY/DayrTbVGZhsQwNfTACYJw2+j7qMv2JO1zlvRt5+XHXGGNxjvLugvDWd27Od/VRf7nS4b6JmeL7ex/1YVDZeBhRxrQukQYkFEcNkZr7PfCp+7HltrXClV+2uqCh4+YGWuqAZbfIpcVFL1k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792461901; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=UebSHfNGHCnl3lV5FG/Q9b7I36P06qarQ39hZQcc+E0=; b=mLvg/jbadgbjs2e3S4K2urgRtMETVu4nB8OEa9J+BLgD6zm8/v3J9y8M5TnQ5LAcg1cGfOUMx8FC4Ee34ie94NhRg4Ao6vw1u/JpKAdELa0uw05IdwnOaHnfgtvveCMmThdzCob6HMkJiM5cUUSmSyTuz1WNTWZQ5j3QF3bG270= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792461901588565.2265946755026; Mon, 19 Oct 2026 19:05:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xIzCr-00011Q-Aq; Mon, 19 Oct 2026 22:04:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIzCp-00010k-2k for qemu-devel@nongnu.org; Mon, 19 Oct 2026 22:03:59 -0400 Received: from mx0a-0031df01.pphosted.com ([205.220.168.131]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xIzCm-0003jB-Tq for qemu-devel@nongnu.org; Mon, 19 Oct 2026 22:03:58 -0400 Received: from pps.filterd (m0279862.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69K0t7743806878 for ; Tue, 20 Oct 2026 02:03:55 GMT Received: from mail-dy1-f199.google.com (mail-dy1-f199.google.com [74.125.82.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4hdw5p8d0f-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 20 Oct 2026 02:03:55 +0000 (GMT) Received: by mail-dy1-f199.google.com with SMTP id 5a478bee46e88-33c35f5ca6cso5668910eec.1 for ; Mon, 19 Oct 2026 19:03:55 -0700 (PDT) Received: from hu-bcain-lv.qualcomm.com (Global_NAT1.qualcomm.com. [129.46.96.20]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-1831a6f58c2sm49452078c88.11.2026.10.19.19.03.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Oct 2026 19:03:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= UebSHfNGHCnl3lV5FG/Q9b7I36P06qarQ39hZQcc+E0=; b=hXRpV/8YqNpOg/1v Z/d8CXNuKSEwOAFAESF57b8AXfEkcf1ZzFbTlDkaL2EEqQpbb4iuZPZol5GJInLj G/jHrmpqVDPS/80+dZ7Ts701vDFfyLMyesG9QXv6dj1CVToFIu83IZec7Djc0xMF QN619hrJrebmZ4nNXvuXkkQZ1jM1wcx2xQVVKq47pwmsesalCGN3EMBaSeAoTcyZ 5HirP8oWIjtCkQh0tjkjjs1Ka3XVf1rkbIGTZmv5DHJ3i2EliBekNa1cKHK6kqXx dkxP5Ytfuz6FXe+/XNX8BgrLTOjQwbIbMErbqMFiLNhELppPpHpIwxMTUpgl2XNw vkXvug== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1792461835; x=1793066635; darn=nongnu.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=UebSHfNGHCnl3lV5FG/Q9b7I36P06qarQ39hZQcc+E0=; b=P2k9nts6uBlEYIIb2n0GFRZunj9ZnKixb+l5ZGoKO00kaGtSXXQTIjTYqNNGKRv8Y7 ndjCUVQXuoogPUBSCFOG/cQ3KnLGWKSedRfevQjLWUOBAfu5wBoIsVZKR0RQPjDFG9k0 wnUdw3fD4xMWADDyvwC1o6qx7r5WoJGL8Zh2rVzFRkkCFQZjKGxhKfTVvWt3umTkNOrH P8dFm347m7WIhwz82rCePBlASL7L2dIP+Ck9bjED9YkEv/R9IX7QILnvtDiQ0azHtfe4 YHgkbKgIod1+pA/VnIMqGKYqcJhENuiIdSU2nsuGVEvBk4qKDnJeqInyxqXvU71kP4gY D/ZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792461835; x=1793066635; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=UebSHfNGHCnl3lV5FG/Q9b7I36P06qarQ39hZQcc+E0=; b=BCN21eo060R7Ry4fdXJuf6ys0V6NQxsqKBrAbB/J5IHvxAQArZSgveOMFlalbxLaiQ P9aayf00cr8GJpAkmb+uWJHhMOjU1K1q+SngCi8sWdT05iFng+pmqYpSbOZhOVk0fFW/ 9ItSCcBc7ffA19EBvAjpwwpFaeNkwCoZKc8U2QOoBqio/uGk+V327Jd/gLx6ZvDCQGO9 D237ULCVK21S+2QNa5xOUqAmL+IkvXXq8p+JHc4bkFF7F16LfOhzpz9UUPMzkYM4QFP6 0gnJexdtCQan9EuN7pnrsP9bfO2KR8TrUXLpxrJNUegi4pREXARpTeIPX98NIM0yCCF0 LAGg== X-Gm-Message-State: AFq9FYKtUVEITzuL68FAs2LhSqPMLafp7Q9ciCKgEzUupqGfeqAFD9b5 XhKB9ATG4sM81FXpiuAAYbo16PihR9ShOMPWxObQ6u4sDFLDct8XHgmtd6C6cDjG8NWYhfsAkWa Wh/UhXcuxXX+64S1e5isnUjOekayiuZWb7xs1HVKvC86y3+4yVIfVj4qL+JxyrsBbxQ== X-Gm-Gg: AYBFou3dOpCnfhGSxF3Q4GAx5T/XHBMB/AWzfjerBdlq2GjzloHqHv4WD6jC1KLedNI 8dlr4M4PdPM2v+X5CHaCbhdTbSKp1ldFAf4jjnVcPxOu13Ll0OQXh+dcEVbvQFJwzctd1rFMXLm fxqmIghSlKbvLpHRRtTbbEUvArXXiwTGpSVXgNgmo1Rzm9l5qJ0t8gLhSBNXSQW2PgQhNNTzKY6 vLbS9as86C8eydZzih4C8pzIhWhGSdboW/Q/kBUOIBmq+3bBosyDvsaW6nRgUJMK7r+P74tm8AQ RwnEP/2Q3DGzgaDFe/tiy+/PpAnXhQwv0T4YTnl3O7vBELh+sJFrsmIBJTovYhfDd+QPq5/IVwa hgDu2ZbQhwZ2XKEQLJty6my23WxzIDybzq4qrAvwO9SbbHZGd X-Received: by 2002:a05:7023:b0f:b0:14d:c53a:f6a0 with SMTP id a92af1059eb24-18512c3833dmr19861532c88.13.1792461834615; Mon, 19 Oct 2026 19:03:54 -0700 (PDT) X-Received: by 2002:a05:7023:b0f:b0:14d:c53a:f6a0 with SMTP id a92af1059eb24-18512c3833dmr19861510c88.13.1792461834099; Mon, 19 Oct 2026 19:03:54 -0700 (PDT) From: Brian Cain To: qemu-devel@nongnu.org Cc: philmd@oss.qualcomm.com, peter.maydell@linaro.org, Brian Cain , Pierrick Bouvier Subject: [PATCH v5 4/4] target/hexagon: fix semihosting ACCESS filename handling Date: Mon, 19 Oct 2026 19:03:42 -0700 Message-Id: <20261020020342.3619566-5-brian.cain@oss.qualcomm.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261020020342.3619566-1-brian.cain@oss.qualcomm.com> References: <20261020020342.3619566-1-brian.cain@oss.qualcomm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Proofpoint-GUID: y3gtZ-buUF3HuMN5JAEAKd5wwQxQRG7k X-Authority-Analysis: v=2.4 cv=fb84WEQF c=1 sm=1 tr=0 ts=6ad6cc0b cx=c_pps a=cFYjgdjTJScbgFmBucgdfQ==:117 a=ouPCqIW2jiPt+lZRy3xVPw==:17 a=IkcTkHD0fZMA:10 a=660iZSQnnn4A:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_K5XuSEh1TEqbUxoQ0s3:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=KKAkSRfTAAAA:8 a=EUspDBNiAAAA:8 a=pS50CBgNNeok3lFgILkA:9 a=QEXdDO2ut3YA:10 a=scEy_gLbYbu1JhEsrz4S:22 a=cvBusfyB2V15izCimMoJ:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDIwMDAwNyBTYWx0ZWRfXxMVgMHB6insI FjFnY/atVyLEq5TgMccTmYjZTeZFdxySjovenOC6E4kNowYZaVacyLeg7R3+20FnX4r7XrHBYlb 7W1Pq+cVSLE7Z0O2EdNtKdIqBLvC/Wnp8t1m4hU3nTyoLbXS1AL0ixyptNHbb11ubMTlajgDxGr 4OBtxyX9dlzdK+EtaM4ZiQFDefvSLKTgQs8giKuMQWh3ns57JHFgZKdJE31T0qy4JiPxq+G3np7 znFDOVuTm0YvgiKJ2WKybfIFbWum7dtsiGa7xer0PGVI6JSyxduODOWrywz43SEYWz2dz9f2QmN Lf4cJCkDwKKjLD62jsOA+ieeGCOwsdeWB6M5eQjwJf1hstKTZf4K6yHdnM+mn9vludISuFdgPbG oAEHRhigdQf7l5Ym8+fVzBWLMEuQORJ/2QDuXc7MGRmX8XadK3JBDWNarRtdNOwzqkHA5pDMCvJ pvLF4+yHgDtS9IC3mOQ== X-Proofpoint-Spam-Info: AW1haW4tMjYxMDIwMDAwNyBTYWx0ZWRfX/HGI1nfunGld oflEdb7tOPBhIDSPEAQ6Y5H3GnoMEypQAidg4j9qZPDLegMlmqaCZ7DDBueE0BIApAzyTkVBtSh 4HHp+dSkgRR/NdoJ/Ujb1pLKR6hQji0= X-Proofpoint-ORIG-GUID: y3gtZ-buUF3HuMN5JAEAKd5wwQxQRG7k X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-20_01,2026-10-19_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 malwarescore=0 lowpriorityscore=0 suspectscore=0 adultscore=0 phishscore=0 clxscore=1015 bulkscore=0 spamscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610190000 definitions=main-2610200007 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=205.220.168.131; envelope-from=brian.cain@oss.qualcomm.com; helo=mx0a-0031df01.pphosted.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @qualcomm.com) X-ZM-MESSAGEID: 1792461903189158500 HEX_SYS_ACCESS wrote a NUL byte past its fixed-size filename buffer when the guest string filled it. Use lock_user_string() to avoid the out-of-boun= ds write. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting ope= rations") Resolves: Coverity CID 1685942 Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ= 2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Reviewed-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/hexswi.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index a5c8ee27c7e..9ff72253385 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -626,26 +626,24 @@ static void sim_handle_trap0(CPUHexagonState *env) =20 case HEX_SYS_ACCESS: { - char filename[BUFSIZ]; + char *filename; uint32_t FileNameAddr; uint32_t BufferMode; - int rc; - - int i =3D 0; + int rc, err; =20 if (get_user_u32(FileNameAddr, swi_info) || get_user_u32(BufferMode, swi_info + 4)) { goto do_fault; } - do { - if (get_user_u8(filename[i], FileNameAddr + i)) { - goto do_fault; - } - i++; - } while ((i < BUFSIZ) && (filename[i - 1])); - filename[i] =3D 0; + filename =3D lock_user_string(FileNameAddr); + if (!filename) { + semi_cb(cs, -1, EFAULT); + break; + } rc =3D access(filename, BufferMode); - semi_cb(cs, rc, rc =3D=3D 0 ? 0 : errno); + err =3D errno; + unlock_user(filename, FileNameAddr, 0); + semi_cb(cs, rc, rc =3D=3D 0 ? 0 : err); } break; =20 --=20 2.34.1