From patchwork Thu Aug 24 15:32:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 1825468 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256 header.s=google header.b=rjEdiZuv; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-ppc-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RWnDV2jNxz1yZs for ; Fri, 25 Aug 2023 01:33:46 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qZCKJ-0001XZ-6u; Thu, 24 Aug 2023 11:32:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qZCK0-0001Qe-Px for qemu-ppc@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: from mail-wr1-x429.google.com ([2a00:1450:4864:20::429]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qZCJw-0003RL-6j for qemu-ppc@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: by mail-wr1-x429.google.com with SMTP id ffacd0b85a97d-31aec0a1a8bso23371f8f.0 for ; Thu, 24 Aug 2023 08:32:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+p4+7OBfarchATd3tFruYfwM1HUum7CKIwxdMycnIKM=; b=rjEdiZuvlGmaAlCSjOgehf8AnR+PPGiHqtfxMBDODCEBuGswKVHLOipVpPHxJ1wQte 8nvGZTRf3fBY/SNRthg3Ti2ktm0/dgqWA6rLHyAr+2txhydN2pVP7+Hit2i9SVVzb0PX g65Si9hmz8Amk6DgGynJHYx/lE6VsUuIQycW7z2F+gyR72uzHppZOkaD+EdwrVzrHzJt Jk9n5aI4iAvSqdR7XFdVWSEn+6Ijh/s9zVK/lvtyrkdK2qu/OCWskAervwodVofONOKk JUUR/iYW4PrPOcRMmTz97FRPxupRh7G/Z5k+Bo9reN0s6YdBQ+ntT+/Q7POu8WeHwl80 7sDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=+p4+7OBfarchATd3tFruYfwM1HUum7CKIwxdMycnIKM=; b=BdzgjTGuptzPDXmGjv9PxT38eKOVJFrFVviGIHXWWiEaDazxDt31lP5N0rZ7q51nSJ bzA4vidnkVfIFdxt/Kyi1B+RoFkBdX4lWM2VVAFitCENSnHTw1KL6XLfzdgEArvssSjd gVuG4qesxKXuSN1R3p6JQmPlOaztj61zO4QBq1wdmFYGb/XrSsKn/FnJi5u8CujYu2/G TzGQhBTIXheAYJU14eisQaLLSrYSOtajQpOayJ7JG2zcQv5hQyc1cixubKZ1H+suLRp0 /8yk93GGOxOL45b0YtycxQkXmJgKNbeX6KBdCFzJSageKFKeME+kFM1A7j25+I+Soop6 +KEg== X-Gm-Message-State: AOJu0YySFsUrMWCf5ryYQUDTMZCXZW/68S6ddQK6rzIzAggYXRBXvsEu /SnoMfwVSc7IATE3CaEaY7klplu5yvkRpKJwIsU= X-Google-Smtp-Source: AGHT+IHpIdFP676ocbdhQb1AMHameThAhSaFK8hRjB5+lE+E/aJpzvdt8A/yJ8plO+JBHU0RzqZLng== X-Received: by 2002:a5d:688a:0:b0:317:e68f:e1af with SMTP id h10-20020a5d688a000000b00317e68fe1afmr12101385wru.20.1692891146209; Thu, 24 Aug 2023 08:32:26 -0700 (PDT) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by smtp.gmail.com with ESMTPSA id x4-20020adff0c4000000b003180fdf5589sm22918640wro.6.2023.08.24.08.32.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 08:32:25 -0700 (PDT) From: Peter Maydell To: qemu-devel@nongnu.org Cc: Jason Wang , Jiri Pirko , qemu-ppc@nongnu.org Subject: [PATCH 1/4] hw/net/fsl_etsec/rings.c: Avoid variable length array Date: Thu, 24 Aug 2023 16:32:21 +0100 Message-Id: <20230824153224.2517486-2-peter.maydell@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230824153224.2517486-1-peter.maydell@linaro.org> References: <20230824153224.2517486-1-peter.maydell@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::429; envelope-from=peter.maydell@linaro.org; helo=mail-wr1-x429.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-ppc@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-ppc-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-ppc-bounces+incoming=patchwork.ozlabs.org@nongnu.org In fill_rx_bd() we create a variable length array of size etsec->rx_padding. In fact we know that this will never be larger than 64 bytes, because rx_padding is set in rx_init_frame() in a way that ensures it is only that large. Use a fixed sized array and assert that it is big enough. Since padd[] is now potentially rather larger than the actual padding required, adjust the memset() we do on it to match the size that we write with cpu_physical_memory_write(), rather than clearing the entire array. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé --- hw/net/fsl_etsec/rings.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/hw/net/fsl_etsec/rings.c b/hw/net/fsl_etsec/rings.c index 788463f1b62..2f2f359f7a5 100644 --- a/hw/net/fsl_etsec/rings.c +++ b/hw/net/fsl_etsec/rings.c @@ -372,6 +372,12 @@ void etsec_walk_tx_ring(eTSEC *etsec, int ring_nbr) etsec->regs[TSTAT].value |= 1 << (31 - ring_nbr); } +/* + * rx_init_frame() ensures we never do more padding than this + * (checksum plus minimum data packet size) + */ +#define MAX_RX_PADDING 64 + static void fill_rx_bd(eTSEC *etsec, eTSEC_rxtx_bd *bd, const uint8_t **buf, @@ -380,9 +386,11 @@ static void fill_rx_bd(eTSEC *etsec, uint16_t to_write; hwaddr bufptr = bd->bufptr + ((hwaddr)(etsec->regs[TBDBPH].value & 0xF) << 32); - uint8_t padd[etsec->rx_padding]; + uint8_t padd[MAX_RX_PADDING]; uint8_t rem; + assert(etsec->rx_padding <= MAX_RX_PADDING); + RING_DEBUG("eTSEC fill Rx buffer @ 0x%016" HWADDR_PRIx " size:%zu(padding + crc:%u) + fcb:%u\n", bufptr, *size, etsec->rx_padding, etsec->rx_fcb_size); @@ -426,7 +434,7 @@ static void fill_rx_bd(eTSEC *etsec, rem = MIN(etsec->regs[MRBLR].value - bd->length, etsec->rx_padding); if (rem > 0) { - memset(padd, 0x0, sizeof(padd)); + memset(padd, 0x0, rem); etsec->rx_padding -= rem; *size -= rem; bd->length += rem;