From patchwork Thu Jan 3 08:56:34 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 1020195 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=208.118.235.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43Vhdf16z5z9s9G for ; Thu, 3 Jan 2019 19:57:58 +1100 (AEDT) Received: from localhost ([127.0.0.1]:49814 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1geypA-0003EI-1N for incoming@patchwork.ozlabs.org; Thu, 03 Jan 2019 03:57:56 -0500 Received: from eggs.gnu.org ([208.118.235.92]:47481) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1geyoX-0003CZ-Bx for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:18 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1geyoU-00015w-H7 for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:17 -0500 Received: from mx1.redhat.com ([209.132.183.28]:54612) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1geyoU-0000u8-9P for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:14 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 7DEE9142BEF for ; Thu, 3 Jan 2019 08:56:59 +0000 (UTC) Received: from x1w.redhat.com (unknown [10.40.205.99]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E19F65D9C5; Thu, 3 Jan 2019 08:56:54 +0000 (UTC) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Date: Thu, 3 Jan 2019 09:56:34 +0100 Message-Id: <20190103085638.17600-2-philmd@redhat.com> In-Reply-To: <20190103085638.17600-1-philmd@redhat.com> References: <20190103085638.17600-1-philmd@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Thu, 03 Jan 2019 08:56:59 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v5 1/5] qemu/compiler: Define QEMU_NONSTRING X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Thomas Huth , David Hildenbrand , "Michael S. Tsirkin" , "Dr. David Alan Gilbert" , Markus Armbruster , =?utf-8?q?Marc-Andr=C3=A9_Lure?= =?utf-8?q?au?= , Paolo Bonzini , Igor Mammedov , =?utf-8?q?Philippe_Mathieu-Daud?= =?utf-8?b?w6k=?= Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" GCC 8 introduced the -Wstringop-truncation checker to detect truncation by the strncat and strncpy functions (closely related to -Wstringop-overflow, which detect buffer overflow by string-modifying functions declared in ). In tandem of -Wstringop-truncation, the "nonstring" attribute was added: The nonstring variable attribute specifies that an object or member declaration with type array of char, signed char, or unsigned char, or pointer to such a type is intended to store character arrays that do not necessarily contain a terminating NUL. This is useful in detecting uses of such arrays or pointers with functions that expect NUL-terminated strings, and to avoid warnings when such an array or pointer is used as an argument to a bounded string manipulation function such as strncpy. From the GCC manual: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-nonstring-variable-attribute Add the QEMU_NONSTRING macro which checks if the compiler supports this attribute. Suggested-by: Michael S. Tsirkin Reviewed-by: Eric Blake Reviewed-by: Michael S. Tsirkin Reviewed-by: Richard Henderson Reviewed-by: Thomas Huth Signed-off-by: Philippe Mathieu-Daudé --- v4: reordered the commit description to make sens (eblake) Note this trigger the following checkpatch warning (patchew) which I'm ignoring because this is consistent with how the rest of this file uses: WARNING: architecture specific defines should be avoided #50: FILE: include/qemu/compiler.h:163: +#if __has_attribute(nonstring) --- include/qemu/compiler.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h index 261842beae..2d8f507c73 100644 --- a/include/qemu/compiler.h +++ b/include/qemu/compiler.h @@ -151,6 +151,21 @@ # define QEMU_ERROR(X) #endif +/* + * The nonstring variable attribute specifies that an object or member + * declaration with type array of char or pointer to char is intended + * to store character arrays that do not necessarily contain a terminating + * NUL character. This is useful in detecting uses of such arrays or pointers + * with functions that expect NUL-terminated strings, and to avoid warnings + * when such an array or pointer is used as an argument to a bounded string + * manipulation function such as strncpy. + */ +#if __has_attribute(nonstring) +# define QEMU_NONSTRING __attribute__((nonstring)) +#else +# define QEMU_NONSTRING +#endif + /* Implement C11 _Generic via GCC builtins. Example: * * QEMU_GENERIC(x, (float, sinf), (long double, sinl), sin) (x) From patchwork Thu Jan 3 08:56:35 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 1020196 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=listsout.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from listsout.gnu.org (listsout.gnu.org [209.51.188.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43Vhdr6j6zz9s4s for ; Thu, 3 Jan 2019 19:58:08 +1100 (AEDT) Received: from localhost ([127.0.0.1]:49818 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1geypJ-0003Qe-EB for incoming@patchwork.ozlabs.org; Thu, 03 Jan 2019 03:58:05 -0500 Received: from eggs.gnu.org ([208.118.235.92]:47533) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1geyoa-0003Fr-NB for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:21 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1geyoZ-0001Cs-P5 for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:20 -0500 Received: from mx1.redhat.com ([209.132.183.28]:48816) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1geyoX-00019M-LT; Thu, 03 Jan 2019 03:57:17 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id DC1143C2CC9; Thu, 3 Jan 2019 08:57:16 +0000 (UTC) Received: from x1w.redhat.com (unknown [10.40.205.99]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 1C9075D9C5; Thu, 3 Jan 2019 08:56:59 +0000 (UTC) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Date: Thu, 3 Jan 2019 09:56:35 +0100 Message-Id: <20190103085638.17600-3-philmd@redhat.com> In-Reply-To: <20190103085638.17600-1-philmd@redhat.com> References: <20190103085638.17600-1-philmd@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Thu, 03 Jan 2019 08:57:16 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v5 2/5] block/sheepdog: Use QEMU_NONSTRING for non NUL-terminated arrays X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , Thomas Huth , "open list:Sheepdog" , David Hildenbrand , Jeff Cody , "Michael S. Tsirkin" , "Dr. David Alan Gilbert" , Markus Armbruster , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Paolo Bonzini , Igor Mammedov , Liu Yuan , Max Reitz , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" GCC 8 added a -Wstringop-truncation warning: The -Wstringop-truncation warning added in GCC 8.0 via r254630 for bug 81117 is specifically intended to highlight likely unintended uses of the strncpy function that truncate the terminating NUL character from the source string. This new warning leads to compilation failures: CC block/sheepdog.o qemu/block/sheepdog.c: In function 'find_vdi_name': qemu/block/sheepdog.c:1239:5: error: 'strncpy' specified bound 256 equals destination size [-Werror=stringop-truncation] strncpy(buf + SD_MAX_VDI_LEN, tag, SD_MAX_VDI_TAG_LEN); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ make: *** [qemu/rules.mak:69: block/sheepdog.o] Error 1 As described previous to the strncpy() calls, the use of strncpy() is correct here: /* This pair of strncpy calls ensures that the buffer is zero-filled, * which is desirable since we'll soon be sending those bytes, and * don't want the send_req to read uninitialized data. */ strncpy(buf, filename, SD_MAX_VDI_LEN); strncpy(buf + SD_MAX_VDI_LEN, tag, SD_MAX_VDI_TAG_LEN); Use the QEMU_NONSTRING attribute, since this array is intended to store character arrays that do not necessarily contain a terminating NUL. Suggested-by: Michael S. Tsirkin Reviewed-by: Eric Blake Reviewed-by: Michael S. Tsirkin Signed-off-by: Philippe Mathieu-Daudé --- block/sheepdog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/sheepdog.c b/block/sheepdog.c index 0125df9d49..5cd9618432 100644 --- a/block/sheepdog.c +++ b/block/sheepdog.c @@ -1224,7 +1224,7 @@ static int find_vdi_name(BDRVSheepdogState *s, const char *filename, SheepdogVdiReq hdr; SheepdogVdiRsp *rsp = (SheepdogVdiRsp *)&hdr; unsigned int wlen, rlen = 0; - char buf[SD_MAX_VDI_LEN + SD_MAX_VDI_TAG_LEN]; + char buf[SD_MAX_VDI_LEN + SD_MAX_VDI_TAG_LEN] QEMU_NONSTRING; fd = connect_to_sdog(s, errp); if (fd < 0) { From patchwork Thu Jan 3 08:56:36 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 1020198 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=listsout.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from listsout.gnu.org (listsout.gnu.org [209.51.188.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43VhhD3yXCz9s9G for ; Thu, 3 Jan 2019 20:00:12 +1100 (AEDT) Received: from localhost ([127.0.0.1]:49834 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1geyrK-0005mP-2k for incoming@patchwork.ozlabs.org; Thu, 03 Jan 2019 04:00:10 -0500 Received: from eggs.gnu.org ([208.118.235.92]:47591) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1geyoh-0003Mp-QE for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:28 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1geyof-0001Jy-2o for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:27 -0500 Received: from mx1.redhat.com ([209.132.183.28]:49708) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1geyoe-0001Ii-QJ for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:24 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 23F4FC04BE30 for ; Thu, 3 Jan 2019 08:57:24 +0000 (UTC) Received: from x1w.redhat.com (unknown [10.40.205.99]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 6EE495D9C5; Thu, 3 Jan 2019 08:57:17 +0000 (UTC) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Date: Thu, 3 Jan 2019 09:56:36 +0100 Message-Id: <20190103085638.17600-4-philmd@redhat.com> In-Reply-To: <20190103085638.17600-1-philmd@redhat.com> References: <20190103085638.17600-1-philmd@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Thu, 03 Jan 2019 08:57:24 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v5 3/5] hw/acpi: Use QEMU_NONSTRING for non NUL-terminated arrays X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Thomas Huth , David Hildenbrand , "Michael S. Tsirkin" , "Dr. David Alan Gilbert" , Markus Armbruster , =?utf-8?q?Marc-Andr=C3=A9_Lure?= =?utf-8?q?au?= , Paolo Bonzini , Igor Mammedov , =?utf-8?q?Philippe_Mathieu-Daud?= =?utf-8?b?w6k=?= Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" GCC 8 added a -Wstringop-truncation warning: The -Wstringop-truncation warning added in GCC 8.0 via r254630 for bug 81117 is specifically intended to highlight likely unintended uses of the strncpy function that truncate the terminating NUL character from the source string. This new warning leads to compilation failures: CC hw/acpi/core.o In function 'acpi_table_install', inlined from 'acpi_table_add' at qemu/hw/acpi/core.c:296:5: qemu/hw/acpi/core.c:184:9: error: 'strncpy' specified bound 4 equals destination size [-Werror=stringop-truncation] strncpy(ext_hdr->sig, hdrs->sig, sizeof ext_hdr->sig); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ make: *** [qemu/rules.mak:69: hw/acpi/core.o] Error 1 Use the QEMU_NONSTRING attribute, since ACPI tables don't require the strings to be NUL-terminated. Suggested-by: Michael S. Tsirkin Reviewed-by: Michael S. Tsirkin Reviewed-by: Igor Mammedov Signed-off-by: Philippe Mathieu-Daudé --- v4: rebased v5: Fix checkpatch error: space prohibited before open square bracket '[' Note this triggers the following checkpatch warning (patchew), which is incorrect because this is a multi-line macro, thus we can not use Linux-kernel-style multiline comments here: WARNING: Block comments use a leading /* on a separate line #83: FILE: include/hw/acpi/acpi-defs.h:61: + QEMU_NONSTRING; /* OEM identification */ \ --- hw/acpi/core.c | 12 ++++++++---- include/hw/acpi/acpi-defs.h | 13 ++++++++----- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/hw/acpi/core.c b/hw/acpi/core.c index d6f0709691..47877c0ec1 100644 --- a/hw/acpi/core.c +++ b/hw/acpi/core.c @@ -35,14 +35,18 @@ struct acpi_table_header { uint16_t _length; /* our length, not actual part of the hdr */ /* allows easier parsing for fw_cfg clients */ - char sig[4]; /* ACPI signature (4 ASCII characters) */ + char sig[4] + QEMU_NONSTRING; /* ACPI signature (4 ASCII characters) */ uint32_t length; /* Length of table, in bytes, including header */ uint8_t revision; /* ACPI Specification minor version # */ uint8_t checksum; /* To make sum of entire table == 0 */ - char oem_id[6]; /* OEM identification */ - char oem_table_id[8]; /* OEM table identification */ + char oem_id[6] + QEMU_NONSTRING; /* OEM identification */ + char oem_table_id[8] + QEMU_NONSTRING; /* OEM table identification */ uint32_t oem_revision; /* OEM revision number */ - char asl_compiler_id[4]; /* ASL compiler vendor ID */ + char asl_compiler_id[4] + QEMU_NONSTRING; /* ASL compiler vendor ID */ uint32_t asl_compiler_revision; /* ASL compiler revision number */ } QEMU_PACKED; diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h index 5021cb9e79..4ed160afae 100644 --- a/include/hw/acpi/acpi-defs.h +++ b/include/hw/acpi/acpi-defs.h @@ -41,8 +41,8 @@ enum { }; typedef struct AcpiRsdpData { - uint8_t oem_id[6]; /* OEM identification */ - uint8_t revision; /* Must be 0 for 1.0, 2 for 2.0 */ + uint8_t oem_id[6] QEMU_NONSTRING; /* OEM identification */ + uint8_t revision; /* Must be 0 for 1.0, 2 for 2.0 */ unsigned *rsdt_tbl_offset; unsigned *xsdt_tbl_offset; @@ -57,10 +57,13 @@ typedef struct AcpiRsdpData { uint32_t length; /* Length of table, in bytes, including header */ \ uint8_t revision; /* ACPI Specification minor version # */ \ uint8_t checksum; /* To make sum of entire table == 0 */ \ - uint8_t oem_id [6]; /* OEM identification */ \ - uint8_t oem_table_id [8]; /* OEM table identification */ \ + uint8_t oem_id[6] \ + QEMU_NONSTRING; /* OEM identification */ \ + uint8_t oem_table_id[8] \ + QEMU_NONSTRING; /* OEM table identification */ \ uint32_t oem_revision; /* OEM revision number */ \ - uint8_t asl_compiler_id [4]; /* ASL compiler vendor ID */ \ + uint8_t asl_compiler_id[4] \ + QEMU_NONSTRING; /* ASL compiler vendor ID */ \ uint32_t asl_compiler_revision; /* ASL compiler revision number */ From patchwork Thu Jan 3 08:56:37 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 1020197 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=208.118.235.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43Vhgf6S38z9s4s for ; Thu, 3 Jan 2019 19:59:42 +1100 (AEDT) Received: from localhost ([127.0.0.1]:49828 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1geyqq-00058e-Oh for incoming@patchwork.ozlabs.org; Thu, 03 Jan 2019 03:59:40 -0500 Received: from eggs.gnu.org ([208.118.235.92]:47642) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1geyow-0003ZR-4F for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:42 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1geyos-0001Z4-Q5 for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:41 -0500 Received: from mx1.redhat.com ([209.132.183.28]:49038) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1geyos-0001YH-K0 for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:38 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id EE1F92CD7F7 for ; Thu, 3 Jan 2019 08:57:37 +0000 (UTC) Received: from x1w.redhat.com (unknown [10.40.205.99]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 9759F5D9C5; Thu, 3 Jan 2019 08:57:24 +0000 (UTC) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Date: Thu, 3 Jan 2019 09:56:37 +0100 Message-Id: <20190103085638.17600-5-philmd@redhat.com> In-Reply-To: <20190103085638.17600-1-philmd@redhat.com> References: <20190103085638.17600-1-philmd@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Thu, 03 Jan 2019 08:57:37 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v5 4/5] migration: Fix stringop-truncation warning X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Thomas Huth , Juan Quintela , David Hildenbrand , "Michael S. Tsirkin" , "Dr. David Alan Gilbert" , Markus Armbruster , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Paolo Bonzini , Igor Mammedov , =?utf-8?q?Philippe_Mathieu-Daud?= =?utf-8?b?w6k=?= Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" From: Marc-André Lureau GCC 8 added a -Wstringop-truncation warning: The -Wstringop-truncation warning added in GCC 8.0 via r254630 for bug 81117 is specifically intended to highlight likely unintended uses of the strncpy function that truncate the terminating NUL character from the source string. This new warning leads to compilation failures: CC migration/global_state.o qemu/migration/global_state.c: In function 'global_state_store_running': qemu/migration/global_state.c:45:5: error: 'strncpy' specified bound 100 equals destination size [-Werror=stringop-truncation] strncpy((char *)global_state.runstate, state, sizeof(global_state.runstate)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ make: *** [qemu/rules.mak:69: migration/global_state.o] Error 1 Adding an assert is enough to silence GCC. (alternatively, we could hard-code "running") Signed-off-by: Marc-André Lureau Reviewed-by: Eric Blake Reviewed-by: Dr. David Alan Gilbert Reviewed-by: Philippe Mathieu-Daudé [PMD: More verbose commit message] Signed-off-by: Philippe Mathieu-Daudé --- migration/global_state.c | 1 + 1 file changed, 1 insertion(+) diff --git a/migration/global_state.c b/migration/global_state.c index 8e8ab5c51e..01805c567a 100644 --- a/migration/global_state.c +++ b/migration/global_state.c @@ -42,6 +42,7 @@ int global_state_store(void) void global_state_store_running(void) { const char *state = RunState_str(RUN_STATE_RUNNING); + assert(strlen(state) < sizeof(global_state.runstate)); strncpy((char *)global_state.runstate, state, sizeof(global_state.runstate)); } From patchwork Thu Jan 3 08:56:38 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 1020199 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=208.118.235.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=redhat.com Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 43Vhk03swzz9s4s for ; Thu, 3 Jan 2019 20:01:44 +1100 (AEDT) Received: from localhost ([127.0.0.1]:49855 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1geyso-0007NE-EH for incoming@patchwork.ozlabs.org; Thu, 03 Jan 2019 04:01:42 -0500 Received: from eggs.gnu.org ([208.118.235.92]:47699) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1geyp9-0003nB-9u for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:58 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1geyp3-0001gk-MH for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:53 -0500 Received: from mx1.redhat.com ([209.132.183.28]:35221) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1geyp1-0001eW-Ku for qemu-devel@nongnu.org; Thu, 03 Jan 2019 03:57:49 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id B64E8142BEF for ; Thu, 3 Jan 2019 08:57:44 +0000 (UTC) Received: from x1w.redhat.com (unknown [10.40.205.99]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 7A56D5D9C5; Thu, 3 Jan 2019 08:57:38 +0000 (UTC) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Date: Thu, 3 Jan 2019 09:56:38 +0100 Message-Id: <20190103085638.17600-6-philmd@redhat.com> In-Reply-To: <20190103085638.17600-1-philmd@redhat.com> References: <20190103085638.17600-1-philmd@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Thu, 03 Jan 2019 08:57:44 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v5 5/5] migration: Use strnlen() for fixed-size string X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Thomas Huth , Juan Quintela , David Hildenbrand , "Michael S. Tsirkin" , "Dr. David Alan Gilbert" , Markus Armbruster , =?utf-8?q?Marc-Andr=C3=A9_Lureau?= , Paolo Bonzini , Igor Mammedov , =?utf-8?q?Philippe_Mathieu-Daud?= =?utf-8?b?w6k=?= Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" GCC 8 introduced the -Wstringop-overflow, which detect buffer overflow by string-modifying functions declared in , such strncpy(), used in global_state_store_running(). GCC indeed found an incorrect use of strlen(), because this array is loaded by VMSTATE_BUFFER(runstate, GlobalState) then parsed using qapi_enum_parse which does not get the buffer length. Use strnlen() which returns sizeof(s->runstate) if the array is not NUL-terminated, assert the size is within range, and enforce the array to be NUL-terminated to avoid an overflow in qapi_enum_parse(). This fixes: CC migration/global_state.o qemu/migration/global_state.c: In function 'global_state_pre_save': qemu/migration/global_state.c:109:15: error: 'strlen' argument 1 declared attribute 'nonstring' [-Werror=stringop-overflow=] s->size = strlen((char *)s->runstate) + 1; ^~~~~~~~~~~~~~~~~~~~~~~~~~~ qemu/migration/global_state.c:24:13: note: argument 'runstate' declared here uint8_t runstate[100] QEMU_NONSTRING; ^~~~~~~~ cc1: all warnings being treated as errors make: *** [qemu/rules.mak:69: migration/global_state.o] Error 1 Suggested-by: Michael S. Tsirkin Reviewed-by: Richard Henderson Reviewed-by: Dr. David Alan Gilbert Signed-off-by: Philippe Mathieu-Daudé --- v5: Use Linux-kernel-style multiline comments --- migration/global_state.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/migration/global_state.c b/migration/global_state.c index 01805c567a..2c8c447239 100644 --- a/migration/global_state.c +++ b/migration/global_state.c @@ -89,6 +89,17 @@ static int global_state_post_load(void *opaque, int version_id) s->received = true; trace_migrate_global_state_post_load(runstate); + if (strnlen((char *)s->runstate, + sizeof(s->runstate)) == sizeof(s->runstate)) { + /* + * This condition should never happen during migration, because + * all runstate names are shorter than 100 bytes (the size of + * s->runstate). However, a malicious stream could overflow + * the qapi_enum_parse() call, so we force the last character + * to a NUL byte. + */ + s->runstate[sizeof(s->runstate) - 1] = '\0'; + } r = qapi_enum_parse(&RunState_lookup, runstate, -1, &local_err); if (r == -1) { @@ -107,7 +118,8 @@ static int global_state_pre_save(void *opaque) GlobalState *s = opaque; trace_migrate_global_state_pre_save((char *)s->runstate); - s->size = strlen((char *)s->runstate) + 1; + s->size = strnlen((char *)s->runstate, sizeof(s->runstate)) + 1; + assert(s->size <= sizeof(s->runstate)); return 0; }