From patchwork Thu Oct 13 02:53:39 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li Qiang X-Patchwork-Id: 681580 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3svb1M5c8Lz9t0w for ; Thu, 13 Oct 2016 13:54:46 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b=AvbxZmb7; dkim-atps=neutral Received: from localhost ([::1]:37247 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1buWAL-0003jL-G0 for incoming@patchwork.ozlabs.org; Wed, 12 Oct 2016 22:54:41 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42234) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1buW9f-0003Re-HR for qemu-devel@nongnu.org; Wed, 12 Oct 2016 22:54:00 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1buW9a-0006kG-Fm for qemu-devel@nongnu.org; Wed, 12 Oct 2016 22:53:59 -0400 Received: from mail-lf0-x242.google.com ([2a00:1450:4010:c07::242]:36259) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1buW9a-0006jx-7T for qemu-devel@nongnu.org; Wed, 12 Oct 2016 22:53:54 -0400 Received: by mail-lf0-x242.google.com with SMTP id b75so10025719lfg.3 for ; Wed, 12 Oct 2016 19:53:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:from:to:cc:subject:date; bh=U77naTRdZZD52XPnbcAcSk3/q93i9nzjK9QHedq5CZE=; b=AvbxZmb7OV4iYQ3mzF+ckADnNADF0ClRoiwzPM4uuaw+vet3yoTW2NSaD6RRzlVy3D XHw8ywI+iizgB4SaSjgZWXyuua3eD8kYNn8slzQ9VdiLy+yF3bNXSaZ9HOFKOFdioOJl 80vGQkMv+ZjiWArsqeMHvxzh+nKRSedgklMNQZ0Dut/bzjIkvOFAg6xmLUxevUPmV411 R8I4ZT2iVMLD8OD9zfZZ3PrzCD5/+7Pk8XgmHOVQgWyJqzgJdyozFDV+NoT9yHZzfFYU YhKI282CHVCNbM+BDLt1miDx24Wfoa/pR16mmmj7hT1RHCh4Joi5HEQj6pSAtL7f8fTc RsTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:from:to:cc:subject:date; bh=U77naTRdZZD52XPnbcAcSk3/q93i9nzjK9QHedq5CZE=; b=J/PEvavabEoEHLh8vrQlOHo+crEEqUEzweNfrfSZRqwfrwZ6w3xV8p71NC973KoKrF 8+eQzCkEHZBj7ANqeiLuMeT3Z6xrDFyZv3Z6Tloc1CVQRZEx01btfCHWCiw4Z86T6gzP R3JT0OiUjOLwi6SBArbdYT6uAVxmnUpFkoTuwHo+g4rAREDPLV9UMuqszUhemqbtbn+s BdZ4LElGJcgKLeZA4yB4gCmt3yD1NaPTzZZPLHMK9SSKFE9X0sJrSy4uS5lJJGA+iCYm lHbSlbtUhv2P8fsdJuGqUMMbNQEjQQ8TsW0rOPtEui53orG1dElK3f42ZZMNgUmAkgZr GYNg== X-Gm-Message-State: AA6/9RnaV+OREXgTnf0ezIEcyegxGLx/RjEE621oo6b2ZfOYXIL4M++lXORlqDyhU6/I+Q== X-Received: by 10.28.26.193 with SMTP id a184mr318597wma.93.1476327233075; Wed, 12 Oct 2016 19:53:53 -0700 (PDT) Received: from localhost.localdomain.localdomain ([104.192.110.250]) by smtp.gmail.com with ESMTPSA id h10sm18155934wje.48.2016.10.12.19.53.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 12 Oct 2016 19:53:52 -0700 (PDT) Message-ID: <57fef740.ca13c20a.19dbb.98b6@mx.google.com> X-Google-Original-Message-ID: <1476327219-5760-1-git-send-email-Qiang(liqiang6-s@360.cn)> From: Li Qiang X-Google-Original-From: Li Qiang(liqiang6-s@360.cn) To: groug@kaod.org, qemu-devel@nongnu.org Date: Wed, 12 Oct 2016 19:53:39 -0700 X-Mailer: git-send-email 1.8.3.1 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2a00:1450:4010:c07::242 Subject: [Qemu-devel] [PATCH v2] 9pfs: fix integer overflow issue in xattr read/write X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Li Qiang Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" From: Li Qiang In 9pfs xattr read/write function, it mix to use unsigned/signed ,32/64 bits integers. This will causes oob read/write issues. This patch fix this. Signed-off-by: Li Qiang --- hw/9pfs/9p.c | 34 +++++++++++++--------------------- hw/9pfs/9p.h | 4 ++-- 2 files changed, 15 insertions(+), 23 deletions(-) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index e4040dc..8c7488f 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -1642,20 +1642,17 @@ static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp, { ssize_t err; size_t offset = 7; - int read_count; - int64_t xattr_len; + uint64_t read_count; V9fsVirtioState *v = container_of(s, V9fsVirtioState, state); VirtQueueElement *elem = v->elems[pdu->idx]; - xattr_len = fidp->fs.xattr.len; - read_count = xattr_len - off; + if (fidp->fs.xattr.len < off) { + read_count = 0; + } else { + read_count = fidp->fs.xattr.len - off; + } if (read_count > max_count) { read_count = max_count; - } else if (read_count < 0) { - /* - * read beyond XATTR value - */ - read_count = 0; } err = pdu_marshal(pdu, offset, "d", read_count); if (err < 0) { @@ -1982,23 +1979,18 @@ static int v9fs_xattr_write(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp, { int i, to_copy; ssize_t err = 0; - int write_count; - int64_t xattr_len; + uint64_t write_count; size_t offset = 7; - xattr_len = fidp->fs.xattr.len; - write_count = xattr_len - off; - if (write_count > count) { - write_count = count; - } else if (write_count < 0) { - /* - * write beyond XATTR value len specified in - * xattrcreate - */ + if (fidp->fs.xattr.len < off) { err = -ENOSPC; goto out; } + write_count = fidp->fs.xattr.len - off; + if (write_count > count) { + write_count = count; + } err = pdu_marshal(pdu, offset, "d", write_count); if (err < 0) { return err; @@ -3254,7 +3246,7 @@ static void v9fs_xattrcreate(void *opaque) { int flags; int32_t fid; - int64_t size; + uint64_t size; ssize_t err = 0; V9fsString name; size_t offset = 7; diff --git a/hw/9pfs/9p.h b/hw/9pfs/9p.h index d539d2e..22198f6 100644 --- a/hw/9pfs/9p.h +++ b/hw/9pfs/9p.h @@ -159,8 +159,8 @@ typedef struct V9fsConf typedef struct V9fsXattr { - int64_t copied_len; - int64_t len; + uint64_t copied_len; + uint64_t len; void *value; V9fsString name; int flags;