Much like noted in 43d5c5d5f70b ("xen: avoid UB in guest handle
arithmetic"), address calculations involved in accessing a struct field
can overflow, too. Cast respective pointers to "unsigned long" and
convert type checking accordingly. Remaining arithmetic is, despite
there possibly being mathematical overflow, okay as per the C99 spec:
"A computation involving unsigned operands can never overflow, because a
result that cannot be represented by the resulting unsigned integer type
is reduced modulo the number that is one greater than the largest value
that can be represented by the resulting type." The overflow that we
need to guard against is checked for in array_access_ok().

While there add the missing (see {,__}copy_to_guest_offset()) is-not-
const checks to {,__}copy_field_to_guest().

Typically, but not always, no change to generated code; code generation
(register allocation) is different for at least common/grant_table.c.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
---
I notice that {,__}copy_field_from_guest() are actually unused, which
may not be all that surprising: There's perhaps little point in copying
in just a single field, as then any further input fields of a struct
would likely also need copying that way (to avoid multi-read issues).
copy_field_to_guest() has a mere two callers, in x86. All other sites
use __copy_field_to_guest(). Overall there may hence be room here for
simplification / reduction of redundancy.

--- unstable.orig/xen/include/xen/guest_access.h	2024-06-24 13:48:30.384279937 +0200
+++ unstable/xen/include/xen/guest_access.h	2024-06-24 13:51:35.390248096 +0200
@@ -95,16 +95,23 @@
 /* Copy sub-field of a structure to guest context via a guest handle. */
 #define copy_field_to_guest(hnd, ptr, field) ({         \
     const typeof(&(ptr)->field) _s = &(ptr)->field;     \
-    void *_d = &(hnd).p->field;                         \
-    (void)(&(hnd).p->field == _s);                      \
-    raw_copy_to_guest(_d, _s, sizeof(*_s));             \
+    unsigned long d_ = (unsigned long)(hnd).p;          \
+    /* Check that the handle is not for a const type */ \
+    void *__maybe_unused _t = (hnd).p;                  \
+    (void)((typeof_field(typeof(*(hnd).p), field) *)NULL == _s); \
+    raw_copy_to_guest((void *)(d_ + offsetof(typeof(*(hnd).p), field)), \
+                      _s, sizeof(*_s));                 \
 })
 
 /* Copy sub-field of a structure from guest context via a guest handle. */
 #define copy_field_from_guest(ptr, hnd, field) ({       \
-    const typeof(&(ptr)->field) _s = &(hnd).p->field;   \
+    unsigned long s_ = (unsigned long)(hnd).p;          \
     typeof(&(ptr)->field) _d = &(ptr)->field;           \
-    raw_copy_from_guest(_d, _s, sizeof(*_d));           \
+    (void)((typeof_field(typeof(*(hnd).p), field) *)NULL == _d); \
+    raw_copy_from_guest(_d,                             \
+                        (const void *)(s_ +             \
+                            offsetof(typeof(*(hnd).p), field)), \
+                        sizeof(*_d));                   \
 })
 
 #define copy_to_guest(hnd, ptr, nr)                     \
@@ -149,15 +156,22 @@
 
 #define __copy_field_to_guest(hnd, ptr, field) ({       \
     const typeof(&(ptr)->field) _s = &(ptr)->field;     \
-    void *_d = &(hnd).p->field;                         \
-    (void)(&(hnd).p->field == _s);                      \
-    __raw_copy_to_guest(_d, _s, sizeof(*_s));           \
+    unsigned long d_ = (unsigned long)(hnd).p;          \
+    /* Check that the handle is not for a const type */ \
+    void *__maybe_unused _t = (hnd).p;                  \
+    (void)((typeof_field(typeof(*(hnd).p), field) *)NULL == _s); \
+    __raw_copy_to_guest((void *)(d_ + offsetof(typeof(*(hnd).p), field)), \
+                        _s, sizeof(*_s));               \
 })
 
 #define __copy_field_from_guest(ptr, hnd, field) ({     \
-    const typeof(&(ptr)->field) _s = &(hnd).p->field;   \
+    unsigned long s_ = (unsigned long)(hnd).p;          \
     typeof(&(ptr)->field) _d = &(ptr)->field;           \
-    __raw_copy_from_guest(_d, _s, sizeof(*_d));         \
+    (void)((typeof_field(typeof(*(hnd).p), field) *)NULL == _d); \
+    __raw_copy_from_guest(_d,                           \
+                          (const void *)(s_ +           \
+                              offsetof(typeof(*(hnd).p), field)), \
+                          sizeof(*_d));                 \
 })
 
 #define __copy_to_guest(hnd, ptr, nr)                   \

On 24/06/2024 1:28 pm, Jan Beulich wrote:
> Much like noted in 43d5c5d5f70b ("xen: avoid UB in guest handle
> arithmetic"), address calculations involved in accessing a struct field
> can overflow, too. Cast respective pointers to "unsigned long" and
> convert type checking accordingly. Remaining arithmetic is, despite
> there possibly being mathematical overflow, okay as per the C99 spec:
> "A computation involving unsigned operands can never overflow, because a
> result that cannot be represented by the resulting unsigned integer type
> is reduced modulo the number that is one greater than the largest value
> that can be represented by the resulting type." The overflow that we
> need to guard against is checked for in array_access_ok().
>
> While there add the missing (see {,__}copy_to_guest_offset()) is-not-
> const checks to {,__}copy_field_to_guest().
>
> Typically, but not always, no change to generated code; code generation
> (register allocation) is different for at least common/grant_table.c.
>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>

On Mon, 2024-07-01 at 16:36 +0100, Andrew Cooper wrote:
> On 24/06/2024 1:28 pm, Jan Beulich wrote:
> > Much like noted in 43d5c5d5f70b ("xen: avoid UB in guest handle
> > arithmetic"), address calculations involved in accessing a struct
> > field
> > can overflow, too. Cast respective pointers to "unsigned long" and
> > convert type checking accordingly. Remaining arithmetic is, despite
> > there possibly being mathematical overflow, okay as per the C99
> > spec:
> > "A computation involving unsigned operands can never overflow,
> > because a
> > result that cannot be represented by the resulting unsigned integer
> > type
> > is reduced modulo the number that is one greater than the largest
> > value
> > that can be represented by the resulting type." The overflow that
> > we
> > need to guard against is checked for in array_access_ok().
> > 
> > While there add the missing (see {,__}copy_to_guest_offset()) is-
> > not-
> > const checks to {,__}copy_field_to_guest().
> > 
> > Typically, but not always, no change to generated code; code
> > generation
> > (register allocation) is different for at least
> > common/grant_table.c.
> > 
> > Signed-off-by: Jan Beulich <jbeulich@suse.com>
> 
> Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>

Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@gmail.com>

~ Oleksii