* Re: [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax
2026-07-08 15:05 [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax Max Filippov
@ 2026-07-08 15:40 ` Alex Bennée
2026-07-08 20:02 ` Richard Henderson
` (3 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: Alex Bennée @ 2026-07-08 15:40 UTC (permalink / raw)
To: Max Filippov; +Cc: qemu-devel, Ilya Leoshkevich
Max Filippov <jcmvbkbc@gmail.com> writes:
> Fix new_argv allocation size to be `(argc + 2) * sizeof(char *)` bytes,
> which matches the way it's used to store `argc + 2` pointers.
>
> This fixes the test for me, which otherwise fails on xtensa with the
> following message
>
> linux-sigrtminmax.c: 59: main: Assertion `execve(new_argv[0], new_argv, environ) == 0' failed.'.
>
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
> ---
> tests/tcg/multiarch/linux/linux-sigrtminmax.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tests/tcg/multiarch/linux/linux-sigrtminmax.c b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> index a7059aacd9cb..b5ea65f3d393 100644
> --- a/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> +++ b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> @@ -39,7 +39,7 @@ int main(int argc, char **argv)
> assert(qemu);
>
> if (!getenv("QEMU_RTSIG_MAP")) {
> - char **new_argv = malloc((argc + 2) + sizeof(char *));
> + char **new_argv = malloc((argc + 2) * sizeof(char *));
> int tsig1, hsig1, count1, tsig2, hsig2, count2;
> char rt_sigmap[64];
--
Alex Bennée
Virtualisation Tech Lead @ Linaro
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax
2026-07-08 15:05 [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax Max Filippov
2026-07-08 15:40 ` Alex Bennée
@ 2026-07-08 20:02 ` Richard Henderson
2026-07-08 20:45 ` Philippe Mathieu-Daudé
` (2 subsequent siblings)
4 siblings, 0 replies; 8+ messages in thread
From: Richard Henderson @ 2026-07-08 20:02 UTC (permalink / raw)
To: qemu-devel
On 7/8/26 08:05, Max Filippov wrote:
> Fix new_argv allocation size to be `(argc + 2) * sizeof(char *)` bytes,
> which matches the way it's used to store `argc + 2` pointers.
>
> This fixes the test for me, which otherwise fails on xtensa with the
> following message
>
> linux-sigrtminmax.c: 59: main: Assertion `execve(new_argv[0], new_argv, environ) == 0' failed.'.
>
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
> ---
> tests/tcg/multiarch/linux/linux-sigrtminmax.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
r~
>
> diff --git a/tests/tcg/multiarch/linux/linux-sigrtminmax.c b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> index a7059aacd9cb..b5ea65f3d393 100644
> --- a/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> +++ b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> @@ -39,7 +39,7 @@ int main(int argc, char **argv)
> assert(qemu);
>
> if (!getenv("QEMU_RTSIG_MAP")) {
> - char **new_argv = malloc((argc + 2) + sizeof(char *));
> + char **new_argv = malloc((argc + 2) * sizeof(char *));
> int tsig1, hsig1, count1, tsig2, hsig2, count2;
> char rt_sigmap[64];
>
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax
2026-07-08 15:05 [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax Max Filippov
2026-07-08 15:40 ` Alex Bennée
2026-07-08 20:02 ` Richard Henderson
@ 2026-07-08 20:45 ` Philippe Mathieu-Daudé
2026-07-09 8:37 ` Ilya Leoshkevich
2026-07-09 8:56 ` Markus Armbruster
4 siblings, 0 replies; 8+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-07-08 20:45 UTC (permalink / raw)
To: Max Filippov, qemu-devel; +Cc: Alex Bennée, Ilya Leoshkevich
On 8/7/26 17:05, Max Filippov wrote:
> Fix new_argv allocation size to be `(argc + 2) * sizeof(char *)` bytes,
> which matches the way it's used to store `argc + 2` pointers.
>
> This fixes the test for me, which otherwise fails on xtensa with the
> following message
>
> linux-sigrtminmax.c: 59: main: Assertion `execve(new_argv[0], new_argv, environ) == 0' failed.'.
>
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
> ---
> tests/tcg/multiarch/linux/linux-sigrtminmax.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Fixes: 6f58b090328 ("tests/tcg: Add SIGRTMIN/SIGRTMAX test")
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax
2026-07-08 15:05 [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax Max Filippov
` (2 preceding siblings ...)
2026-07-08 20:45 ` Philippe Mathieu-Daudé
@ 2026-07-09 8:37 ` Ilya Leoshkevich
2026-07-09 8:56 ` Markus Armbruster
4 siblings, 0 replies; 8+ messages in thread
From: Ilya Leoshkevich @ 2026-07-09 8:37 UTC (permalink / raw)
To: Max Filippov, qemu-devel; +Cc: Alex Bennée
On 7/8/26 17:05, Max Filippov wrote:
> Fix new_argv allocation size to be `(argc + 2) * sizeof(char *)` bytes,
> which matches the way it's used to store `argc + 2` pointers.
>
> This fixes the test for me, which otherwise fails on xtensa with the
> following message
>
> linux-sigrtminmax.c: 59: main: Assertion `execve(new_argv[0], new_argv, environ) == 0' failed.'.
>
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
> ---
> tests/tcg/multiarch/linux/linux-sigrtminmax.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tests/tcg/multiarch/linux/linux-sigrtminmax.c b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> index a7059aacd9cb..b5ea65f3d393 100644
> --- a/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> +++ b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> @@ -39,7 +39,7 @@ int main(int argc, char **argv)
> assert(qemu);
>
> if (!getenv("QEMU_RTSIG_MAP")) {
> - char **new_argv = malloc((argc + 2) + sizeof(char *));
> + char **new_argv = malloc((argc + 2) * sizeof(char *));
> int tsig1, hsig1, count1, tsig2, hsig2, count2;
> char rt_sigmap[64];
>
Whoops, a silly typo on my part.
Thanks for taking the time to fix it!
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax
2026-07-08 15:05 [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax Max Filippov
` (3 preceding siblings ...)
2026-07-09 8:37 ` Ilya Leoshkevich
@ 2026-07-09 8:56 ` Markus Armbruster
2026-07-09 8:58 ` Daniel P. Berrangé
2026-07-09 9:09 ` Alex Bennée
4 siblings, 2 replies; 8+ messages in thread
From: Markus Armbruster @ 2026-07-09 8:56 UTC (permalink / raw)
To: Max Filippov; +Cc: qemu-devel, Alex Bennée, Ilya Leoshkevich
Max Filippov <jcmvbkbc@gmail.com> writes:
> Fix new_argv allocation size to be `(argc + 2) * sizeof(char *)` bytes,
> which matches the way it's used to store `argc + 2` pointers.
>
> This fixes the test for me, which otherwise fails on xtensa with the
> following message
>
> linux-sigrtminmax.c: 59: main: Assertion `execve(new_argv[0], new_argv, environ) == 0' failed.'.
>
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
> ---
> tests/tcg/multiarch/linux/linux-sigrtminmax.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tests/tcg/multiarch/linux/linux-sigrtminmax.c b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> index a7059aacd9cb..b5ea65f3d393 100644
> --- a/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> +++ b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> @@ -39,7 +39,7 @@ int main(int argc, char **argv)
> assert(qemu);
>
> if (!getenv("QEMU_RTSIG_MAP")) {
> - char **new_argv = malloc((argc + 2) + sizeof(char *));
> + char **new_argv = malloc((argc + 2) * sizeof(char *));
If you can switch to glib's malloc, then g_new(argc + 2, sizeof(char *))
is better. Yes, @argc can't become big enough for the multiplication to
overflow, but g_new() removes the need for reasoning.
> int tsig1, hsig1, count1, tsig2, hsig2, count2;
> char rt_sigmap[64];
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax
2026-07-09 8:56 ` Markus Armbruster
@ 2026-07-09 8:58 ` Daniel P. Berrangé
2026-07-09 9:09 ` Alex Bennée
1 sibling, 0 replies; 8+ messages in thread
From: Daniel P. Berrangé @ 2026-07-09 8:58 UTC (permalink / raw)
To: Markus Armbruster
Cc: Max Filippov, qemu-devel, Alex Bennée, Ilya Leoshkevich
On Thu, Jul 09, 2026 at 10:56:09AM +0200, Markus Armbruster wrote:
> Max Filippov <jcmvbkbc@gmail.com> writes:
>
> > Fix new_argv allocation size to be `(argc + 2) * sizeof(char *)` bytes,
> > which matches the way it's used to store `argc + 2` pointers.
> >
> > This fixes the test for me, which otherwise fails on xtensa with the
> > following message
> >
> > linux-sigrtminmax.c: 59: main: Assertion `execve(new_argv[0], new_argv, environ) == 0' failed.'.
> >
> > Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
> > ---
> > tests/tcg/multiarch/linux/linux-sigrtminmax.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/tests/tcg/multiarch/linux/linux-sigrtminmax.c b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> > index a7059aacd9cb..b5ea65f3d393 100644
> > --- a/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> > +++ b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
> > @@ -39,7 +39,7 @@ int main(int argc, char **argv)
> > assert(qemu);
> >
> > if (!getenv("QEMU_RTSIG_MAP")) {
> > - char **new_argv = malloc((argc + 2) + sizeof(char *));
> > + char **new_argv = malloc((argc + 2) * sizeof(char *));
>
> If you can switch to glib's malloc, then g_new(argc + 2, sizeof(char *))
> is better. Yes, @argc can't become big enough for the multiplication to
> overflow, but g_new() removes the need for reasoning.
The TCG unit tests don't link to GLib, only basic libc.
Fortunately unit tests have a trusted caller (the QEMU
meson build system), so we don't have to worry about
malicious usage with overflow in this context.
>
> > int tsig1, hsig1, count1, tsig2, hsig2, count2;
> > char rt_sigmap[64];
>
>
With regards,
Daniel
--
|: https://berrange.com ~~ https://hachyderm.io/@berrange :|
|: https://libvirt.org ~~ https://entangle-photo.org :|
|: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] tests/tcg: fix buffer overflow in multiarch/linux/linux-sigrtminmax
2026-07-09 8:56 ` Markus Armbruster
2026-07-09 8:58 ` Daniel P. Berrangé
@ 2026-07-09 9:09 ` Alex Bennée
1 sibling, 0 replies; 8+ messages in thread
From: Alex Bennée @ 2026-07-09 9:09 UTC (permalink / raw)
To: Markus Armbruster; +Cc: Max Filippov, qemu-devel, Ilya Leoshkevich
Markus Armbruster <armbru@redhat.com> writes:
> Max Filippov <jcmvbkbc@gmail.com> writes:
>
>> Fix new_argv allocation size to be `(argc + 2) * sizeof(char *)` bytes,
>> which matches the way it's used to store `argc + 2` pointers.
>>
>> This fixes the test for me, which otherwise fails on xtensa with the
>> following message
>>
>> linux-sigrtminmax.c: 59: main: Assertion `execve(new_argv[0], new_argv, environ) == 0' failed.'.
>>
>> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
>> ---
>> tests/tcg/multiarch/linux/linux-sigrtminmax.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/tests/tcg/multiarch/linux/linux-sigrtminmax.c b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
>> index a7059aacd9cb..b5ea65f3d393 100644
>> --- a/tests/tcg/multiarch/linux/linux-sigrtminmax.c
>> +++ b/tests/tcg/multiarch/linux/linux-sigrtminmax.c
>> @@ -39,7 +39,7 @@ int main(int argc, char **argv)
>> assert(qemu);
>>
>> if (!getenv("QEMU_RTSIG_MAP")) {
>> - char **new_argv = malloc((argc + 2) + sizeof(char *));
>> + char **new_argv = malloc((argc + 2) * sizeof(char *));
>
> If you can switch to glib's malloc, then g_new(argc + 2, sizeof(char *))
> is better. Yes, @argc can't become big enough for the multiplication to
> overflow, but g_new() removes the need for reasoning.
Not for TCG test cases - we are limited to plain old glibc.
>
>> int tsig1, hsig1, count1, tsig2, hsig2, count2;
>> char rt_sigmap[64];
--
Alex Bennée
Virtualisation Tech Lead @ Linaro
^ permalink raw reply [flat|nested] 8+ messages in thread