* [Qemu-devel] [PATCH] ps2: check PS2Queue wptr pointer in post_load routine
@ 2018-06-07 8:02 liujunjie
2018-06-07 8:26 ` Gonglei (Arei)
2018-06-14 10:50 ` liujunjie (A)
0 siblings, 2 replies; 4+ messages in thread
From: liujunjie @ 2018-06-07 8:02 UTC (permalink / raw)
To: kraxel, berrange
Cc: arei.gonglei, wangxinxin.wang, weidong.huang, fangying1,
qemu-devel, liujunjie
In commit 802cbcb7300, most issues have been fixed when qemu guest
migration. But the queue size still need to check whether is equal to
PS2_QUEUE_SIZE. If yes, the wptr should set as 0. Or, wptr would larger
than PS2_QUEUE_SIZE and never come back when ps2_queue_noirq is called.
This could lead to OOB access, add check to avoid it.
Signed-off-by: liujunjie <liujunjie23@huawei.com>
---
hw/input/ps2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index eeec618..fdfcadf 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -927,7 +927,7 @@ static void ps2_common_post_load(PS2State *s)
/* reset rptr/wptr/count */
q->rptr = 0;
- q->wptr = size;
+ q->wptr = (size == PS2_QUEUE_SIZE) ? 0 : size;
q->count = size;
s->update_irq(s->update_arg, q->count != 0);
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH] ps2: check PS2Queue wptr pointer in post_load routine
2018-06-07 8:02 [Qemu-devel] [PATCH] ps2: check PS2Queue wptr pointer in post_load routine liujunjie
@ 2018-06-07 8:26 ` Gonglei (Arei)
2018-06-14 10:50 ` liujunjie (A)
1 sibling, 0 replies; 4+ messages in thread
From: Gonglei (Arei) @ 2018-06-07 8:26 UTC (permalink / raw)
To: liujunjie (A), kraxel@redhat.com, berrange@redhat.com
Cc: wangxin (U), Huangweidong (C), fangying, qemu-devel@nongnu.org
> -----Original Message-----
> From: liujunjie (A)
> Sent: Thursday, June 07, 2018 4:03 PM
> To: kraxel@redhat.com; berrange@redhat.com
> Cc: Gonglei (Arei) <arei.gonglei@huawei.com>; wangxin (U)
> <wangxinxin.wang@huawei.com>; Huangweidong (C)
> <weidong.huang@huawei.com>; fangying <fangying1@huawei.com>;
> qemu-devel@nongnu.org; liujunjie (A) <liujunjie23@huawei.com>
> Subject: [PATCH] ps2: check PS2Queue wptr pointer in post_load routine
>
> In commit 802cbcb7300, most issues have been fixed when qemu guest
> migration. But the queue size still need to check whether is equal to
> PS2_QUEUE_SIZE. If yes, the wptr should set as 0. Or, wptr would larger
> than PS2_QUEUE_SIZE and never come back when ps2_queue_noirq is called.
> This could lead to OOB access, add check to avoid it.
>
> Signed-off-by: liujunjie <liujunjie23@huawei.com>
> ---
> hw/input/ps2.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/input/ps2.c b/hw/input/ps2.c
> index eeec618..fdfcadf 100644
> --- a/hw/input/ps2.c
> +++ b/hw/input/ps2.c
> @@ -927,7 +927,7 @@ static void ps2_common_post_load(PS2State *s)
>
> /* reset rptr/wptr/count */
> q->rptr = 0;
> - q->wptr = size;
> + q->wptr = (size == PS2_QUEUE_SIZE) ? 0 : size;
> q->count = size;
> s->update_irq(s->update_arg, q->count != 0);
> }
> --
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] ps2: check PS2Queue wptr pointer in post_load routine
2018-06-07 8:02 [Qemu-devel] [PATCH] ps2: check PS2Queue wptr pointer in post_load routine liujunjie
2018-06-07 8:26 ` Gonglei (Arei)
@ 2018-06-14 10:50 ` liujunjie (A)
2018-06-18 10:10 ` kraxel
1 sibling, 1 reply; 4+ messages in thread
From: liujunjie (A) @ 2018-06-14 10:50 UTC (permalink / raw)
To: kraxel@redhat.com, berrange@redhat.com
Cc: Gonglei (Arei), wangxin (U), Huangweidong (C), fangying,
qemu-devel@nongnu.org
ping
> -----Original Message-----
> From: liujunjie (A)
> Sent: Thursday, June 07, 2018 4:03 PM
> To: kraxel@redhat.com; berrange@redhat.com
> Cc: Gonglei (Arei) <arei.gonglei@huawei.com>; wangxin (U)
> <wangxinxin.wang@huawei.com>; Huangweidong (C)
> <weidong.huang@huawei.com>; fangying <fangying1@huawei.com>;
> qemu-devel@nongnu.org; liujunjie (A) <liujunjie23@huawei.com>
> Subject: [PATCH] ps2: check PS2Queue wptr pointer in post_load routine
>
> In commit 802cbcb7300, most issues have been fixed when qemu guest
> migration. But the queue size still need to check whether is equal to
> PS2_QUEUE_SIZE. If yes, the wptr should set as 0. Or, wptr would larger than
> PS2_QUEUE_SIZE and never come back when ps2_queue_noirq is called.
> This could lead to OOB access, add check to avoid it.
>
> Signed-off-by: liujunjie <liujunjie23@huawei.com>
> ---
> hw/input/ps2.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/input/ps2.c b/hw/input/ps2.c index eeec618..fdfcadf 100644
> --- a/hw/input/ps2.c
> +++ b/hw/input/ps2.c
> @@ -927,7 +927,7 @@ static void ps2_common_post_load(PS2State *s)
>
> /* reset rptr/wptr/count */
> q->rptr = 0;
> - q->wptr = size;
> + q->wptr = (size == PS2_QUEUE_SIZE) ? 0 : size;
> q->count = size;
> s->update_irq(s->update_arg, q->count != 0); }
> --
> 1.8.3.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] ps2: check PS2Queue wptr pointer in post_load routine
2018-06-14 10:50 ` liujunjie (A)
@ 2018-06-18 10:10 ` kraxel
0 siblings, 0 replies; 4+ messages in thread
From: kraxel @ 2018-06-18 10:10 UTC (permalink / raw)
To: liujunjie (A)
Cc: berrange@redhat.com, Gonglei (Arei), wangxin (U),
Huangweidong (C), fangying, qemu-devel@nongnu.org
On Thu, Jun 14, 2018 at 10:50:47AM +0000, liujunjie (A) wrote:
> ping
Not much activity on input devices, so we have rare pull requests ...
Preparing one now, with this patch added.
cheers,
Gerd
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-06-18 10:11 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-06-07 8:02 [Qemu-devel] [PATCH] ps2: check PS2Queue wptr pointer in post_load routine liujunjie
2018-06-07 8:26 ` Gonglei (Arei)
2018-06-14 10:50 ` liujunjie (A)
2018-06-18 10:10 ` kraxel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).