RE: [PATCH qemu] hw/cxl: Check for zero length features in cmd_features_set_feature()

[Shiju Jose <shiju.jose@huawei.com>]

>-----Original Message-----
>From: qemu-devel-bounces+shiju.jose=huawei.com@nongnu.org <qemu-devel-
>bounces+shiju.jose=huawei.com@nongnu.org> On Behalf Of Jonathan Cameron
>via
>Sent: 08 November 2024 17:58
>To: Michael S . Tsirkin <mst@redhat.com>; Fan Ni <fan.ni@samsung.com>;
>linux-cxl@vger.kernel.org; Peter Maydell <peter.maydell@linaro.org>;
>shiju.jose@huwei.com; qemu-devel@nongnu.org
>Cc: Linuxarm <linuxarm@huawei.com>
>Subject: [PATCH qemu] hw/cxl: Check for zero length features in
>cmd_features_set_feature()
>
>Zero length data for features doesn't make any sense so exclude that case early.
>This fixes the undefined behavior reported by coverity for a zero length
>memcpy().
>
>Resolves CID 1564900 and 1564901
>
>Reported-by: Peter Maydell <peter.maydell@linaro.org>
>Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
>---
> hw/cxl/cxl-mailbox-utils.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
Tested-by: Shiju Jose <shiju.jose@huawei.com>

>diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c index
>2d4d62c454..ce9aa18364 100644
>--- a/hw/cxl/cxl-mailbox-utils.c
>+++ b/hw/cxl/cxl-mailbox-utils.c
>@@ -1288,6 +1288,10 @@ static CXLRetCode cmd_features_set_feature(const
>struct cxl_cmd *cmd,
>     set_feat_info->data_offset = hdr->offset;
>     bytes_to_copy = len_in - sizeof(CXLSetFeatureInHeader);
>
>+    if (bytes_to_copy == 0) {
>+        return CXL_MBOX_INVALID_PAYLOAD_LENGTH;
>+    }
>+
>     if (qemu_uuid_is_equal(&hdr->uuid, &patrol_scrub_uuid)) {
>         if (hdr->version != CXL_MEMDEV_PS_SET_FEATURE_VERSION) {
>             return CXL_MBOX_UNSUPPORTED;
>--
>2.43.0
>