From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:50225)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1Wk6WZ-0003VB-Dy
	for qemu-devel@nongnu.org; Tue, 13 May 2014 02:49:20 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1Wk6WU-0005A7-BN
	for qemu-devel@nongnu.org; Tue, 13 May 2014 02:49:15 -0400
Received: from mx1.redhat.com ([209.132.183.28]:7304)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1Wk6WU-0005A3-2S
	for qemu-devel@nongnu.org; Tue, 13 May 2014 02:49:10 -0400
Message-ID: <1399963742.7118.28.camel@nilsson.home.kraxel.org>
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Tue, 13 May 2014 08:49:02 +0200
In-Reply-To: <33183CC9F5247A488A2544077AF19020815E7FA5@SZXEMA503-MBS.china.huawei.com>
References: <1399896829-16617-1-git-send-email-mst@redhat.com>
	<33183CC9F5247A488A2544077AF19020815E7FA5@SZXEMA503-MBS.china.huawei.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH] usb: fix up post load checks
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "Gonglei (Arei)" <arei.gonglei@huawei.com>
Cc: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>, "dgilbert@redhat.com" <dgilbert@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com>

On Di, 2014-05-13 at 03:02 +0000, Gonglei (Arei) wrote:
> Hi,
> 
> > -----Original Message-----
> > From: qemu-devel-bounces+arei.gonglei=huawei.com@nongnu.org
> > [mailto:qemu-devel-bounces+arei.gonglei=huawei.com@nongnu.org] On
> > Behalf Of Michael S. Tsirkin
> > Sent: Monday, May 12, 2014 8:16 PM
> > To: qemu-devel@nongnu.org
> > Cc: Gerd Hoffmann; dgilbert@redhat.com
> > Subject: [Qemu-devel] [PATCH] usb: fix up post load checks
> > 
> > Correct post load checks:
> > 1. dev->setup_len == sizeof(dev->data_buf)
> >     seems fine, no need to fail migration
> > 2. When state is DATA, passing index > len
> >    will cause memcpy with negative length,
> >    resulting in heap overflow
> > 
> > First of the issues was reported by dgilbert.
> > 
> > Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
> > Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> > ---
> >  hw/usb/bus.c | 5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> > 
> > diff --git a/hw/usb/bus.c b/hw/usb/bus.c
> > index e48b19f..2721719 100644
> > --- a/hw/usb/bus.c
> > +++ b/hw/usb/bus.c
> > @@ -51,8 +51,9 @@ static int usb_device_post_load(void *opaque, int
> > version_id)
> >      }
> >      if (dev->setup_index < 0 ||
> >          dev->setup_len < 0 ||
> > -        dev->setup_index >= sizeof(dev->data_buf) ||
> 
> Does this check should be deleted ?

It's ok, index <= len && len <= sizeof(buf) implies index <= sizeof(buf)

> 
> > -        dev->setup_len >= sizeof(dev->data_buf)) {
> > +        (dev->setup_state == SETUP_STATE_DATA &&
> > +         dev->setup_index > dev->setup_len) ||
> > +        dev->setup_len > sizeof(dev->data_buf)) {
> >          return -EINVAL;
> >      }
> >      return 0;
> > --
> > MST
> 
> Best regards,
> -Gonglei