From patchwork Thu Aug 24 15:32:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 1825473 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256 header.s=google header.b=rjEdiZuv; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RWnFM4MJZz1yZs for ; Fri, 25 Aug 2023 01:34:31 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qZCKH-0001TM-Ix; Thu, 24 Aug 2023 11:32:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qZCK0-0001Qd-PT for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: from mail-wr1-x432.google.com ([2a00:1450:4864:20::432]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qZCJw-0003RK-6i for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: by mail-wr1-x432.google.com with SMTP id ffacd0b85a97d-31c5327e5e8so682439f8f.1 for ; Thu, 24 Aug 2023 08:32:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+p4+7OBfarchATd3tFruYfwM1HUum7CKIwxdMycnIKM=; b=rjEdiZuvlGmaAlCSjOgehf8AnR+PPGiHqtfxMBDODCEBuGswKVHLOipVpPHxJ1wQte 8nvGZTRf3fBY/SNRthg3Ti2ktm0/dgqWA6rLHyAr+2txhydN2pVP7+Hit2i9SVVzb0PX g65Si9hmz8Amk6DgGynJHYx/lE6VsUuIQycW7z2F+gyR72uzHppZOkaD+EdwrVzrHzJt Jk9n5aI4iAvSqdR7XFdVWSEn+6Ijh/s9zVK/lvtyrkdK2qu/OCWskAervwodVofONOKk JUUR/iYW4PrPOcRMmTz97FRPxupRh7G/Z5k+Bo9reN0s6YdBQ+ntT+/Q7POu8WeHwl80 7sDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=+p4+7OBfarchATd3tFruYfwM1HUum7CKIwxdMycnIKM=; b=iaJSPwx/8R4DwEcFN3PkrmzzEHNChD6ZcHMVV605SERSgtiQRVS/LzrgBzhUY53bXd GM1cOtLBNqdCStDcKpapJNr9kMDkzgsE6zUmBxCRXJq7vBUsjHfVikfZ2n/HneRrU6/z 0xqnj3vf4+8+HPWSjuoGroi9gCoI/tsZbix85vGeW8Er7Mlum1DsG4OCRC94jpkKMh+B i7vPe9aH/clnRw6CjbRoA+24rKrj893Vp6pkAQPgasg58N9tQH8dfUktBHfoszgxyxDS fbiK7uS0sLGf0Rg1ABqozdyBQFWEk2VG4NUGnND7e7fzcDapdgU/7D/gaDsw/cRaMMKb fPiA== X-Gm-Message-State: AOJu0Yx5seNI6aiN7Pof1riv/HRWSK1Ta3Cdg1/6WssqdUxlnorITVJq nxFSnKkR/+Njq8r+RUSFfxJHGiAcOgdoTD3fkjs= X-Google-Smtp-Source: AGHT+IHpIdFP676ocbdhQb1AMHameThAhSaFK8hRjB5+lE+E/aJpzvdt8A/yJ8plO+JBHU0RzqZLng== X-Received: by 2002:a5d:688a:0:b0:317:e68f:e1af with SMTP id h10-20020a5d688a000000b00317e68fe1afmr12101385wru.20.1692891146209; Thu, 24 Aug 2023 08:32:26 -0700 (PDT) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by smtp.gmail.com with ESMTPSA id x4-20020adff0c4000000b003180fdf5589sm22918640wro.6.2023.08.24.08.32.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 08:32:25 -0700 (PDT) From: Peter Maydell To: qemu-devel@nongnu.org Cc: Jason Wang , Jiri Pirko , qemu-ppc@nongnu.org Subject: [PATCH 1/4] hw/net/fsl_etsec/rings.c: Avoid variable length array Date: Thu, 24 Aug 2023 16:32:21 +0100 Message-Id: <20230824153224.2517486-2-peter.maydell@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230824153224.2517486-1-peter.maydell@linaro.org> References: <20230824153224.2517486-1-peter.maydell@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::432; envelope-from=peter.maydell@linaro.org; helo=mail-wr1-x432.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org In fill_rx_bd() we create a variable length array of size etsec->rx_padding. In fact we know that this will never be larger than 64 bytes, because rx_padding is set in rx_init_frame() in a way that ensures it is only that large. Use a fixed sized array and assert that it is big enough. Since padd[] is now potentially rather larger than the actual padding required, adjust the memset() we do on it to match the size that we write with cpu_physical_memory_write(), rather than clearing the entire array. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé --- hw/net/fsl_etsec/rings.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/hw/net/fsl_etsec/rings.c b/hw/net/fsl_etsec/rings.c index 788463f1b62..2f2f359f7a5 100644 --- a/hw/net/fsl_etsec/rings.c +++ b/hw/net/fsl_etsec/rings.c @@ -372,6 +372,12 @@ void etsec_walk_tx_ring(eTSEC *etsec, int ring_nbr) etsec->regs[TSTAT].value |= 1 << (31 - ring_nbr); } +/* + * rx_init_frame() ensures we never do more padding than this + * (checksum plus minimum data packet size) + */ +#define MAX_RX_PADDING 64 + static void fill_rx_bd(eTSEC *etsec, eTSEC_rxtx_bd *bd, const uint8_t **buf, @@ -380,9 +386,11 @@ static void fill_rx_bd(eTSEC *etsec, uint16_t to_write; hwaddr bufptr = bd->bufptr + ((hwaddr)(etsec->regs[TBDBPH].value & 0xF) << 32); - uint8_t padd[etsec->rx_padding]; + uint8_t padd[MAX_RX_PADDING]; uint8_t rem; + assert(etsec->rx_padding <= MAX_RX_PADDING); + RING_DEBUG("eTSEC fill Rx buffer @ 0x%016" HWADDR_PRIx " size:%zu(padding + crc:%u) + fcb:%u\n", bufptr, *size, etsec->rx_padding, etsec->rx_fcb_size); @@ -426,7 +434,7 @@ static void fill_rx_bd(eTSEC *etsec, rem = MIN(etsec->regs[MRBLR].value - bd->length, etsec->rx_padding); if (rem > 0) { - memset(padd, 0x0, sizeof(padd)); + memset(padd, 0x0, rem); etsec->rx_padding -= rem; *size -= rem; bd->length += rem; From patchwork Thu Aug 24 15:32:22 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 1825465 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256 header.s=google header.b=nzLFcD71; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RWnD11C3kz1yZs for ; Fri, 25 Aug 2023 01:33:21 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qZCK5-0001RK-NO; Thu, 24 Aug 2023 11:32:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qZCK0-0001QP-F9 for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: from mail-wr1-x433.google.com ([2a00:1450:4864:20::433]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qZCJw-0003RS-G6 for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: by mail-wr1-x433.google.com with SMTP id ffacd0b85a97d-31c5a2e8501so3584360f8f.0 for ; Thu, 24 Aug 2023 08:32:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=N1qWg8feJuZrRJWeFrFVBID4g6bufzzYTzjbonZExcE=; b=nzLFcD71715APsNfj4FDqp0XQORAQxZRmM4ruAmVHK3M+p2dx+pkXGCkExSL9ZkNoM 8bBZ/21U19yIunr5KQC7RQbqx/v5srt0lhvhkaPIiO8ga/szHvjT2Ram5mY8QZEWqaCK AmplR7PrpE7fTJeWLszBgsPxwCO268okt8PS69aGLk4MmXyAhnVauCtDLzgFy02E3AGo DWc/paU2ry7sU5M2b9N0pwbgRJCwkNHja6cTrpRDrPdkmM6H6cJTyALWJhp4Ixyoqy4T 7vSDJsiOmXjAwrqJ6v1AFc6S2eFruSUopnDTahJzxIECNf47J7MdqIG2kkmR0lSPziyO kzmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=N1qWg8feJuZrRJWeFrFVBID4g6bufzzYTzjbonZExcE=; b=kKBSoUwrznUFJs3P7YXbatThF4OEor+gOxuYMwqHJU3wTPpYhZlvxqmU4tw+AtcXE6 RbvQbScGuHDLCeZn5kHFYjocxqCGhoJFFdG0dtwj73dPfE/MrUoP9yJF5rq69Uqyk7ZE lo5qHcvq/JKddUHAyUUWXmRqigX/eETRTL1o/maaxW3y70zQ/b2djsjdEgoKHYJ+P9Lh XiEiuQe/0nPbgRMhVm2AlMPkwqo2N/svLHyydUd9ceGU66i/pdCoguTxOryFlXw7257x i4ypa5Yq2rBwyQI4DfF5g0Qf5fKScmab1FHgx4ZGztnHJs8xwFXXR3lkI3jJ0/DMJHpK fQNg== X-Gm-Message-State: AOJu0YzuzzI1632B3rHsu/qUjmhEm7NzuGW+ZG9FdLrMG9/FUswxldLV t08TjVyb0/ut0QN10gbN7Npa3j082k8wUClOmTk= X-Google-Smtp-Source: AGHT+IF3H6zt7aKWfTx1R02/3hQrzXZKDOKkla9yJIRkicWcKMtghZSiN+vMMEKoD3WsCrqiP65yCQ== X-Received: by 2002:a5d:574d:0:b0:319:6ec3:79c7 with SMTP id q13-20020a5d574d000000b003196ec379c7mr11862725wrw.36.1692891146821; Thu, 24 Aug 2023 08:32:26 -0700 (PDT) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by smtp.gmail.com with ESMTPSA id x4-20020adff0c4000000b003180fdf5589sm22918640wro.6.2023.08.24.08.32.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 08:32:26 -0700 (PDT) From: Peter Maydell To: qemu-devel@nongnu.org Cc: Jason Wang , Jiri Pirko , qemu-ppc@nongnu.org Subject: [PATCH 2/4] hw/net/rocker: Avoid variable length array Date: Thu, 24 Aug 2023 16:32:22 +0100 Message-Id: <20230824153224.2517486-3-peter.maydell@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230824153224.2517486-1-peter.maydell@linaro.org> References: <20230824153224.2517486-1-peter.maydell@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::433; envelope-from=peter.maydell@linaro.org; helo=mail-wr1-x433.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Replace an on-stack variable length array in of_dpa_ig() with a g_autofree heap allocation. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Francisco Iglesias --- hw/net/rocker/rocker_of_dpa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c index dfe47544694..5e16056be66 100644 --- a/hw/net/rocker/rocker_of_dpa.c +++ b/hw/net/rocker/rocker_of_dpa.c @@ -1043,7 +1043,7 @@ static void of_dpa_flow_ig_tbl(OfDpaFlowContext *fc, uint32_t tbl_id) static ssize_t of_dpa_ig(World *world, uint32_t pport, const struct iovec *iov, int iovcnt) { - struct iovec iov_copy[iovcnt + 2]; + g_autofree struct iovec *iov_copy = g_new(struct iovec, iovcnt + 2); OfDpaFlowContext fc = { .of_dpa = world_private(world), .in_pport = pport, From patchwork Thu Aug 24 15:32:23 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 1825469 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256 header.s=google header.b=qc4NdCC/; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RWnDt2wQGz1yZs for ; Fri, 25 Aug 2023 01:34:06 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qZCK5-0001RO-O6; Thu, 24 Aug 2023 11:32:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qZCK0-0001Qc-OK for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: from mail-wr1-x431.google.com ([2a00:1450:4864:20::431]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qZCJw-0003RZ-QN for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: by mail-wr1-x431.google.com with SMTP id ffacd0b85a97d-313e742a787so8649f8f.1 for ; Thu, 24 Aug 2023 08:32:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1692891147; x=1693495947; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=1qYdyuRUyB59fnCJVcILwIEL2Oej6/htVufBepr+AMU=; b=qc4NdCC/sBDHPYgc43jZCxJzBrao70Jwgren4yBhVL6TPt3JGppRsWWCga2cmIHmez U1SjhYcOyiSGl7bQmiYankLQWr9gaf2WRHXwxaGb5ct4PAhohr9uobA0Ut9mImH28ORw 9RkMhozzpbfPCUKtXti1MggehiWhW7m0tKoIr6vo/im1fAiBgRL2yAMEyMcTeGv/3xlq zsNGrYXfZtEk0uwAg/hn0l1DiYSb0L9i2ibbz4yDcZhq6NihJ+lYBF7hP07VwRip4UUe pq8Seh9XW+jiqVDX6TER7im8JB6oWJSM8bpchuJNYTJ2644er6bbTf0IFpLGOEkf8iOQ i+vg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692891147; x=1693495947; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=1qYdyuRUyB59fnCJVcILwIEL2Oej6/htVufBepr+AMU=; b=QlOIE3QctCvuSE/kbIcpjUeq8x0RQd1JCgaEY4+z9GKj9rat8T/8fA+pq3ObslYSBp HV+tET3EAqyrJh49JihjF/aLj8NYoq7F9DOzdYON8GRw3WPq5Uk/1uD7/bRJZ2nOmOL9 fQysmF2u+5+KcbTzNUI8v6Fa7T/AbxG0B2GCd9dvWzMySIonRSlf24H5R7FSkPv3cyjM iYnLv4dGE8WzS597ysrJoxLWDWFJAyclyRKm86CO24Y2yu+uFowYnGiXMUN48PfzFBR2 FxSI5m7y4C2Waj0fm/kSGkiSmcgedrf2HrWTqWO8Mpgnw/8APMRVlELkj/1MVrwG4kEz vehQ== X-Gm-Message-State: AOJu0YxRRjcrBTcuk4/uz1cpgM714IjadSeW3swqeKwUnT3Fm7d07Lla RDohkwgB0LOYCrv8cc80Esl1n8xL73ERo3T/9y4= X-Google-Smtp-Source: AGHT+IGH+/CE4q7rDBqHEzPX1rINx+126Bq5Fzb1S79SzR9+PIRLOOtdON148EFOjJFtIjIHE+PeNQ== X-Received: by 2002:adf:e849:0:b0:317:a499:72c8 with SMTP id d9-20020adfe849000000b00317a49972c8mr10562895wrn.1.1692891147305; Thu, 24 Aug 2023 08:32:27 -0700 (PDT) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by smtp.gmail.com with ESMTPSA id x4-20020adff0c4000000b003180fdf5589sm22918640wro.6.2023.08.24.08.32.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 08:32:27 -0700 (PDT) From: Peter Maydell To: qemu-devel@nongnu.org Cc: Jason Wang , Jiri Pirko , qemu-ppc@nongnu.org Subject: [PATCH 3/4] net/dump: Avoid variable length array Date: Thu, 24 Aug 2023 16:32:23 +0100 Message-Id: <20230824153224.2517486-4-peter.maydell@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230824153224.2517486-1-peter.maydell@linaro.org> References: <20230824153224.2517486-1-peter.maydell@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::431; envelope-from=peter.maydell@linaro.org; helo=mail-wr1-x431.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Use a g_autofree heap allocation instead of a variable length array in dump_receive_iov(). The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Francisco Iglesias --- net/dump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/dump.c b/net/dump.c index 7d05f16ca7a..16073f24582 100644 --- a/net/dump.c +++ b/net/dump.c @@ -68,7 +68,7 @@ static ssize_t dump_receive_iov(DumpState *s, const struct iovec *iov, int cnt, int64_t ts; int caplen; size_t size = iov_size(iov, cnt) - offset; - struct iovec dumpiov[cnt + 1]; + g_autofree struct iovec *dumpiov = g_new(struct iovec, cnt + 1); /* Early return in case of previous error. */ if (s->fd < 0) { From patchwork Thu Aug 24 15:32:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 1825467 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256 header.s=google header.b=snhFSuRq; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org (client-ip=209.51.188.17; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=patchwork.ozlabs.org) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4RWnD961wqz1yZs for ; Fri, 25 Aug 2023 01:33:29 +1000 (AEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qZCKL-0001dy-N7; Thu, 24 Aug 2023 11:32:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qZCK2-0001RJ-B5 for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:36 -0400 Received: from mail-wm1-x32e.google.com ([2a00:1450:4864:20::32e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qZCJx-0003Rk-FL for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:34 -0400 Received: by mail-wm1-x32e.google.com with SMTP id 5b1f17b1804b1-3fef56f7223so33549555e9.3 for ; Thu, 24 Aug 2023 08:32:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1692891148; x=1693495948; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=2MJwmp/YT87omTafaKV+iKF01Q0/GZOVi91ih3V6Y9c=; b=snhFSuRqMgrk+13ZJHN5POLH8fH1pGmd60/+cLqKATpWWi37mSxz1N9rRa4cIEhCdm GFKth4UkfYUz1ELvzCwGR7J8nqNcNOPa0OpqRiKceERQb7suwZIdA/+rcg8htk2Xnj6+ aqwMY66U1ItNfjxkJu5208iKIMKUk0tpliaOi8fH31lCSJVnCM8E8Y2rj/ROkUUAi01R Hu1MK3bcpF/A4zheNUOnYhSKPJkEYsPQM/1wDkDvoitip8H/3UR9mhbs+21Wqt+V51hT R/v7na6hE3DOvfnCr1RH1PMlxhFlXwPMUy4H5YPdAawxUCtu6XrRJPc/31fRBlfE+ZVT jCGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692891148; x=1693495948; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=2MJwmp/YT87omTafaKV+iKF01Q0/GZOVi91ih3V6Y9c=; b=gUYr61zI9BK7e32cI+GjIGssSB9C77VYihLMc/KoSKN+krEswtqG7+RZ7F09k5FpPt x5g+C+ZIco7BQe5f7tSMebu4oKzVrsQBk3KM0mpijgRpJ1095v6xmQkH1aLozQqkjzBd 7EXy+Xfn/VnXysg7JnoqRBBV7T89lyZXmUwhg+1SIgFua9p0/H2tTcMVzcZyxB/MpTlG jhnjyNodvd4JW9eRpLn1clVVbrYmw+Q5LOm1/v1/Eq7fLsNfnI5Zi53Q6xaYJ8urjf7V BGxp1f+5nBonqM71pJxrAztJg6zhVecllFm6+zfo7aDfQImrMa8ehFc8oGh39AZlN0rW /fbg== X-Gm-Message-State: AOJu0YwVxdaXzUGQ7EEEB82u/9jI4eEv4sTxBN9XX88Bdc3Sr6IyDgUd aH/MqKs2tvSxt0xpNPaDUqlivZrMww9AvN/G8ZA= X-Google-Smtp-Source: AGHT+IFNNLkZZHC6rb+AQ/+JZ5irkYYaVhrtUF8eurKftzkzgydvgFyH9H0nUdzvMhB1nuTOtwB/UA== X-Received: by 2002:adf:e645:0:b0:31a:d90e:42cd with SMTP id b5-20020adfe645000000b0031ad90e42cdmr12474790wrn.35.1692891147894; Thu, 24 Aug 2023 08:32:27 -0700 (PDT) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by smtp.gmail.com with ESMTPSA id x4-20020adff0c4000000b003180fdf5589sm22918640wro.6.2023.08.24.08.32.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 08:32:27 -0700 (PDT) From: Peter Maydell To: qemu-devel@nongnu.org Cc: Jason Wang , Jiri Pirko , qemu-ppc@nongnu.org Subject: [PATCH 4/4] net/tap: Avoid variable-length array Date: Thu, 24 Aug 2023 16:32:24 +0100 Message-Id: <20230824153224.2517486-5-peter.maydell@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230824153224.2517486-1-peter.maydell@linaro.org> References: <20230824153224.2517486-1-peter.maydell@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::32e; envelope-from=peter.maydell@linaro.org; helo=mail-wm1-x32e.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Use a heap allocation instead of a variable length array in tap_receive_iov(). The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Francisco Iglesias --- net/tap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/tap.c b/net/tap.c index 1bf085d4228..34b1e3f0918 100644 --- a/net/tap.c +++ b/net/tap.c @@ -117,10 +117,11 @@ static ssize_t tap_receive_iov(NetClientState *nc, const struct iovec *iov, { TAPState *s = DO_UPCAST(TAPState, nc, nc); const struct iovec *iovp = iov; - struct iovec iov_copy[iovcnt + 1]; + g_autofree struct iovec *iov_copy = NULL; struct virtio_net_hdr_mrg_rxbuf hdr = { }; if (s->host_vnet_hdr_len && !s->using_vnet_hdr) { + iov_copy = g_new(struct iovec, iovcnt + 1); iov_copy[0].iov_base = &hdr; iov_copy[0].iov_len = s->host_vnet_hdr_len; memcpy(&iov_copy[1], iov, iovcnt * sizeof(*iov));