From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:52402) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TE8yV-0001cH-J3 for qemu-devel@nongnu.org; Tue, 18 Sep 2012 21:21:12 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TE8yT-00082e-Pf for qemu-devel@nongnu.org; Tue, 18 Sep 2012 21:21:11 -0400 Received: from e23smtp05.au.ibm.com ([202.81.31.147]:34577) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TE8yT-000827-7W for qemu-devel@nongnu.org; Tue, 18 Sep 2012 21:21:09 -0400 Received: from /spool/local by e23smtp05.au.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 19 Sep 2012 11:19:53 +1000 Date: Wed, 19 Sep 2012 10:30:36 +1000 From: David Gibson Message-ID: <20120919003036.GF24695@truffula.fritz.box> References: <1347244257-15586-1-git-send-email-david@gibson.dropbear.id.au> <1347244257-15586-2-git-send-email-david@gibson.dropbear.id.au> <87txuw4ido.fsf@codemonkey.ws> <20120918000852.GB24695@truffula.fritz.box> <50585B00.1060801@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <50585B00.1060801@suse.de> Subject: Re: [Qemu-devel] [PATCH 1/2] qemu-char: BUGFIX, don't call FD_ISSET with negative fd List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Andreas =?iso-8859-1?Q?F=E4rber?= Cc: Anthony Liguori , qemu-devel@nongnu.org, qemu-stable@nongnu.org On Tue, Sep 18, 2012 at 01:29:04PM +0200, Andreas Färber wrote: > Am 18.09.2012 02:08, schrieb David Gibson: > > On Mon, Sep 17, 2012 at 01:24:51PM -0500, Anthony Liguori wrote: > >> David Gibson writes: > >> > >>> tcp_chr_connect(), unlike for example udp_chr_update_read_handler() does > >>> not check if the fd it is using is valid (>= 0) before passing it to > >>> qemu_set_fd_handler2(). If using e.g. a TCP serial port, which is not > >>> initially connected, this can result in -1 being passed to FD_ISSET, which > >>> has undefined behaviour. On x86 it seems to harmlessly return 0, but on > >>> PowerPC, it causes a fortify buffer overflow error to be thrown. > >>> > >>> This patch fixes this by putting an extra test in tcp_chr_connect(), and > >>> also adds an assert qemu_set_fd_handler2() to catch other such errors on > >>> all platforms, rather than just some. > >>> > >>> Signed-off-by: David Gibson > >> > >> Applied. Thanks. > > > > Excellent. > > > > Fwiw, I think this one should go into the stable branch, too. > > ...which you indicate by cc'ing qemu-stable since that is not handled by > Anthony himself. Ah, sorry, I was not aware. Noted for the future. > Queued for stable-0.15. Thanks. -- David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson