From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:35529)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <afaerber@suse.de>) id 1TDvzM-0000Xj-To
	for qemu-devel@nongnu.org; Tue, 18 Sep 2012 07:29:18 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <afaerber@suse.de>) id 1TDvzL-0000fs-PV
	for qemu-devel@nongnu.org; Tue, 18 Sep 2012 07:29:12 -0400
Message-ID: <50585B00.1060801@suse.de>
Date: Tue, 18 Sep 2012 13:29:04 +0200
From: =?ISO-8859-1?Q?Andreas_F=E4rber?= <afaerber@suse.de>
MIME-Version: 1.0
References: <1347244257-15586-1-git-send-email-david@gibson.dropbear.id.au>
	<1347244257-15586-2-git-send-email-david@gibson.dropbear.id.au>
	<87txuw4ido.fsf@codemonkey.ws>
	<20120918000852.GB24695@truffula.fritz.box>
In-Reply-To: <20120918000852.GB24695@truffula.fritz.box>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [Qemu-devel] [PATCH 1/2] qemu-char: BUGFIX,
 don't call FD_ISSET with negative fd
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: David Gibson <dwg@au1.ibm.com>
Cc: Anthony Liguori <aliguori@us.ibm.com>, qemu-devel@nongnu.org, qemu-stable@nongnu.org

Am 18.09.2012 02:08, schrieb David Gibson:
> On Mon, Sep 17, 2012 at 01:24:51PM -0500, Anthony Liguori wrote:
>> David Gibson <david@gibson.dropbear.id.au> writes:
>>
>>> tcp_chr_connect(), unlike for example udp_chr_update_read_handler() d=
oes
>>> not check if the fd it is using is valid (>=3D 0) before passing it t=
o
>>> qemu_set_fd_handler2().  If using e.g. a TCP serial port, which is no=
t
>>> initially connected, this can result in -1 being passed to FD_ISSET, =
which
>>> has undefined behaviour.  On x86 it seems to harmlessly return 0, but=
 on
>>> PowerPC, it causes a fortify buffer overflow error to be thrown.
>>>
>>> This patch fixes this by putting an extra test in tcp_chr_connect(), =
and
>>> also adds an assert qemu_set_fd_handler2() to catch other such errors=
 on
>>> all platforms, rather than just some.
>>>
>>> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
>>
>> Applied. Thanks.
>=20
> Excellent.
>=20
> Fwiw, I think this one should go into the stable branch, too.

...which you indicate by cc'ing qemu-stable since that is not handled by
Anthony himself.

Queued for stable-0.15.

Andreas

--=20
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 N=FCrnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imend=F6rffer; HRB 16746 AG N=FCrnbe=
rg