* [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity
@ 2016-08-22 12:47 Wei Liu
2016-08-22 12:47 ` [PATCH v2 1/2] hvmloader: correctly copy signature to info structures Wei Liu
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Wei Liu @ 2016-08-22 12:47 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Wei Liu, Jan Beulich
Wei Liu (2):
hvmloader: correctly copy signature to info structures
hvmloader: use bound checking in get_module_entry
tools/firmware/hvmloader/hvmloader.c | 4 ++--
tools/firmware/hvmloader/ovmf.c | 8 ++++----
tools/firmware/hvmloader/seabios.c | 8 ++++----
3 files changed, 10 insertions(+), 10 deletions(-)
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 1/2] hvmloader: correctly copy signature to info structures
2016-08-22 12:47 [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
@ 2016-08-22 12:47 ` Wei Liu
2016-08-22 12:53 ` Jan Beulich
2016-08-22 12:47 ` [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry Wei Liu
2016-08-22 13:21 ` [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
2 siblings, 1 reply; 6+ messages in thread
From: Wei Liu @ 2016-08-22 12:47 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Wei Liu, Jan Beulich
The original code used sizeof(info->signature) as the size parameter for
memcpy, which was wrong.
Fix that by using structure assignment.
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
---
tools/firmware/hvmloader/ovmf.c | 8 ++++----
tools/firmware/hvmloader/seabios.c | 8 ++++----
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/tools/firmware/hvmloader/ovmf.c b/tools/firmware/hvmloader/ovmf.c
index b4bcc93..0ac3416 100644
--- a/tools/firmware/hvmloader/ovmf.c
+++ b/tools/firmware/hvmloader/ovmf.c
@@ -68,10 +68,10 @@ static void ovmf_setup_bios_info(void)
{
struct ovmf_info *info = (void *)OVMF_INFO_PHYSICAL_ADDRESS;
- memset(info, 0, sizeof(*info));
-
- memcpy(info->signature, "XenHVMOVMF", sizeof(info->signature));
- info->length = sizeof(*info);
+ *info = (struct ovmf_info) {
+ .signature = "XenHVMOVMF",
+ .length = sizeof(*info)
+ };
}
static void ovmf_finish_bios_info(void)
diff --git a/tools/firmware/hvmloader/seabios.c b/tools/firmware/hvmloader/seabios.c
index 5c9a351..44ff0d7 100644
--- a/tools/firmware/hvmloader/seabios.c
+++ b/tools/firmware/hvmloader/seabios.c
@@ -56,10 +56,10 @@ static void seabios_setup_bios_info(void)
{
struct seabios_info *info = (void *)BIOS_INFO_PHYSICAL_ADDRESS;
- memset(info, 0, sizeof(*info));
-
- memcpy(info->signature, "XenHVMSeaBIOS", sizeof(info->signature));
- info->length = sizeof(*info);
+ *info = (struct seabios_info) {
+ .signature = "XenHVMSeaBIOS",
+ .length = sizeof(*info)
+ };
info->tables = (uint32_t)scratch_alloc(MAX_TABLES*sizeof(uint32_t), 0);
}
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry
2016-08-22 12:47 [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
2016-08-22 12:47 ` [PATCH v2 1/2] hvmloader: correctly copy signature to info structures Wei Liu
@ 2016-08-22 12:47 ` Wei Liu
2016-08-22 12:54 ` Jan Beulich
2016-08-22 13:21 ` [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
2 siblings, 1 reply; 6+ messages in thread
From: Wei Liu @ 2016-08-22 12:47 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Wei Liu, Jan Beulich
Coverity complains:
overflow_before_widen: Potentially overflowing expression
info->nr_modules * 32U with type unsigned int (32 bits, unsigned) is
evaluated using 32-bit arithmetic, and then used in a context that
expects an expression of type uint64_t (64 bits, unsigned).
The overflow is unlikely to happen in reality because we only expect a
few modules.
Fix that by converting the check to use bound checking to placate
Coverity.
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
---
tools/firmware/hvmloader/hvmloader.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/firmware/hvmloader/hvmloader.c b/tools/firmware/hvmloader/hvmloader.c
index 7b32d86..bbd4e34 100644
--- a/tools/firmware/hvmloader/hvmloader.c
+++ b/tools/firmware/hvmloader/hvmloader.c
@@ -272,8 +272,8 @@ const struct hvm_modlist_entry *get_module_entry(
if ( !modlist ||
info->modlist_paddr > UINTPTR_MAX ||
- (info->modlist_paddr + info->nr_modules * sizeof(*modlist) - 1)
- > UINTPTR_MAX )
+ (UINTPTR_MAX - (uintptr_t)info->modlist_paddr) / sizeof(*modlist)
+ < info->nr_modules )
return NULL;
for ( i = 0; i < info->nr_modules; i++ )
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2 1/2] hvmloader: correctly copy signature to info structures
2016-08-22 12:47 ` [PATCH v2 1/2] hvmloader: correctly copy signature to info structures Wei Liu
@ 2016-08-22 12:53 ` Jan Beulich
0 siblings, 0 replies; 6+ messages in thread
From: Jan Beulich @ 2016-08-22 12:53 UTC (permalink / raw)
To: Wei Liu; +Cc: Andrew Cooper, Xen-devel
>>> On 22.08.16 at 14:47, <wei.liu2@citrix.com> wrote:
> The original code used sizeof(info->signature) as the size parameter for
> memcpy, which was wrong.
>
> Fix that by using structure assignment.
>
> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry
2016-08-22 12:47 ` [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry Wei Liu
@ 2016-08-22 12:54 ` Jan Beulich
0 siblings, 0 replies; 6+ messages in thread
From: Jan Beulich @ 2016-08-22 12:54 UTC (permalink / raw)
To: Wei Liu; +Cc: Andrew Cooper, Xen-devel
>>> On 22.08.16 at 14:47, <wei.liu2@citrix.com> wrote:
> Coverity complains:
>
> overflow_before_widen: Potentially overflowing expression
> info->nr_modules * 32U with type unsigned int (32 bits, unsigned) is
> evaluated using 32-bit arithmetic, and then used in a context that
> expects an expression of type uint64_t (64 bits, unsigned).
>
> The overflow is unlikely to happen in reality because we only expect a
> few modules.
>
> Fix that by converting the check to use bound checking to placate
> Coverity.
>
> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity
2016-08-22 12:47 [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
2016-08-22 12:47 ` [PATCH v2 1/2] hvmloader: correctly copy signature to info structures Wei Liu
2016-08-22 12:47 ` [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry Wei Liu
@ 2016-08-22 13:21 ` Wei Liu
2 siblings, 0 replies; 6+ messages in thread
From: Wei Liu @ 2016-08-22 13:21 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Wei Liu, Jan Beulich
On Mon, Aug 22, 2016 at 01:47:51PM +0100, Wei Liu wrote:
> Wei Liu (2):
> hvmloader: correctly copy signature to info structures
> hvmloader: use bound checking in get_module_entry
>
Pushed.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-08-22 13:21 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-08-22 12:47 [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
2016-08-22 12:47 ` [PATCH v2 1/2] hvmloader: correctly copy signature to info structures Wei Liu
2016-08-22 12:53 ` Jan Beulich
2016-08-22 12:47 ` [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry Wei Liu
2016-08-22 12:54 ` Jan Beulich
2016-08-22 13:21 ` [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.