* [PATCH v2 01/30] hw/hyperv/vmbus: Remove unused vmbus_load/save_req()
2021-09-03 17:39 [PATCH v2 00/30] glib: Replace g_memdup() by g_memdup2() Philippe Mathieu-Daudé
@ 2021-09-03 17:39 ` Philippe Mathieu-Daudé
2021-09-03 17:39 ` [PATCH v2 02/30] glib-compat: Introduce g_memdup2() wrapper Philippe Mathieu-Daudé
2021-09-03 17:43 ` [PATCH v2 00/30] glib: Replace g_memdup() by g_memdup2() Philippe Mathieu-Daudé
2 siblings, 0 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-09-03 17:39 UTC (permalink / raw)
To: qemu-devel
Cc: Fam Zheng, Peter Maydell, Michael S. Tsirkin, Jason Wang,
Christian Schoenebeck, Gerd Hoffmann, Eric Blake, qemu-block,
John Snow, David Hildenbrand, Markus Armbruster,
Philippe Mathieu-Daudé, Laurent Vivier, Thomas Huth,
Eduardo Habkost, Richard Henderson, Alex Williamson, qemu-arm,
Alex Bennée, David Gibson, Kevin Wolf,
Vladimir Sementsov-Ogievskiy, Daniel P . Berrange, Hanna Reitz,
qemu-ppc, Paolo Bonzini
vmbus_save_req() and vmbus_load_req() are not used.
Remove them to avoid maintaining dead code.
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
include/hw/hyperv/vmbus.h | 3 --
hw/hyperv/vmbus.c | 59 ---------------------------------------
2 files changed, 62 deletions(-)
diff --git a/include/hw/hyperv/vmbus.h b/include/hw/hyperv/vmbus.h
index f98bea3888d..8ea660dd8e6 100644
--- a/include/hw/hyperv/vmbus.h
+++ b/include/hw/hyperv/vmbus.h
@@ -223,7 +223,4 @@ int vmbus_map_sgl(VMBusChanReq *req, DMADirection dir, struct iovec *iov,
void vmbus_unmap_sgl(VMBusChanReq *req, DMADirection dir, struct iovec *iov,
unsigned iov_cnt, size_t accessed);
-void vmbus_save_req(QEMUFile *f, VMBusChanReq *req);
-void *vmbus_load_req(QEMUFile *f, VMBusDevice *dev, uint32_t size);
-
#endif
diff --git a/hw/hyperv/vmbus.c b/hw/hyperv/vmbus.c
index c9887d5a7bc..18d3c3b9240 100644
--- a/hw/hyperv/vmbus.c
+++ b/hw/hyperv/vmbus.c
@@ -1311,65 +1311,6 @@ static const VMStateDescription vmstate_vmbus_chan_req = {
}
};
-void vmbus_save_req(QEMUFile *f, VMBusChanReq *req)
-{
- VMBusChanReqSave req_save;
-
- req_save.chan_idx = req->chan->subchan_idx;
- req_save.pkt_type = req->pkt_type;
- req_save.msglen = req->msglen;
- req_save.msg = req->msg;
- req_save.transaction_id = req->transaction_id;
- req_save.need_comp = req->need_comp;
- req_save.num = req->sgl.nsg;
- req_save.sgl = g_memdup(req->sgl.sg,
- req_save.num * sizeof(ScatterGatherEntry));
-
- vmstate_save_state(f, &vmstate_vmbus_chan_req, &req_save, NULL);
-
- g_free(req_save.sgl);
-}
-
-void *vmbus_load_req(QEMUFile *f, VMBusDevice *dev, uint32_t size)
-{
- VMBusChanReqSave req_save;
- VMBusChanReq *req = NULL;
- VMBusChannel *chan = NULL;
- uint32_t i;
-
- vmstate_load_state(f, &vmstate_vmbus_chan_req, &req_save, 0);
-
- if (req_save.chan_idx >= dev->num_channels) {
- error_report("%s: %u(chan_idx) > %u(num_channels)", __func__,
- req_save.chan_idx, dev->num_channels);
- goto out;
- }
- chan = &dev->channels[req_save.chan_idx];
-
- if (vmbus_channel_reserve(chan, 0, req_save.msglen)) {
- goto out;
- }
-
- req = vmbus_alloc_req(chan, size, req_save.pkt_type, req_save.msglen,
- req_save.transaction_id, req_save.need_comp);
- if (req_save.msglen) {
- memcpy(req->msg, req_save.msg, req_save.msglen);
- }
-
- for (i = 0; i < req_save.num; i++) {
- qemu_sglist_add(&req->sgl, req_save.sgl[i].base, req_save.sgl[i].len);
- }
-
-out:
- if (req_save.msglen) {
- g_free(req_save.msg);
- }
- if (req_save.num) {
- g_free(req_save.sgl);
- }
- return req;
-}
-
static void channel_event_cb(EventNotifier *e)
{
VMBusChannel *chan = container_of(e, VMBusChannel, notifier);
--
2.31.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH v2 02/30] glib-compat: Introduce g_memdup2() wrapper
2021-09-03 17:39 [PATCH v2 00/30] glib: Replace g_memdup() by g_memdup2() Philippe Mathieu-Daudé
2021-09-03 17:39 ` [PATCH v2 01/30] hw/hyperv/vmbus: Remove unused vmbus_load/save_req() Philippe Mathieu-Daudé
@ 2021-09-03 17:39 ` Philippe Mathieu-Daudé
2021-09-03 17:43 ` [PATCH v2 00/30] glib: Replace g_memdup() by g_memdup2() Philippe Mathieu-Daudé
2 siblings, 0 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-09-03 17:39 UTC (permalink / raw)
To: qemu-devel
Cc: Fam Zheng, Peter Maydell, Michael S. Tsirkin, Jason Wang,
Christian Schoenebeck, Gerd Hoffmann, Eric Blake, qemu-block,
John Snow, David Hildenbrand, Markus Armbruster,
Philippe Mathieu-Daudé, Laurent Vivier, Thomas Huth,
Eduardo Habkost, Richard Henderson, Alex Williamson, qemu-arm,
Alex Bennée, David Gibson, Kevin Wolf,
Vladimir Sementsov-Ogievskiy, Daniel P . Berrange, Hanna Reitz,
qemu-ppc, Paolo Bonzini
When experimenting raising GLIB_VERSION_MIN_REQUIRED to 2.68
(Fedora 34 provides GLib 2.68.1) we get:
hw/virtio/virtio-crypto.c:245:24: error: 'g_memdup' is deprecated: Use 'g_memdup2' instead [-Werror,-Wdeprecated-declarations]
...
g_memdup() has been updated by g_memdup2() to fix eventual security
issues (size argument is 32-bit and could be truncated / wrapping).
GLib recommends to copy their static inline version of g_memdup2():
https://discourse.gnome.org/t/port-your-module-from-g-memdup-to-g-memdup2-now/5538
Our glib-compat.h provides a comment explaining how to deal with
these deprecated declarations (see commit e71e8cc0355
"glib: enforce the minimum required version and warn about old APIs").
Following this comment suggestion, implement the g_memdup2_qemu()
wrapper to g_memdup2(), and use the safer equivalent inlined when
we are using pre-2.68 GLib.
Reported-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
include/glib-compat.h | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/include/glib-compat.h b/include/glib-compat.h
index 9e95c888f54..915d0156da0 100644
--- a/include/glib-compat.h
+++ b/include/glib-compat.h
@@ -68,6 +68,43 @@
* without generating warnings.
*/
+/*
+ * g_memdup2_qemu:
+ * @mem: (nullable): the memory to copy.
+ * @byte_size: the number of bytes to copy.
+ *
+ * Allocates @byte_size bytes of memory, and copies @byte_size bytes into it
+ * from @mem. If @mem is %NULL it returns %NULL.
+ *
+ * This replaces g_memdup(), which was prone to integer overflows when
+ * converting the argument from a #gsize to a #guint.
+ *
+ * This static inline version is a backport of the new public API from
+ * GLib 2.68, kept internal to GLib for backport to older stable releases.
+ * See https://gitlab.gnome.org/GNOME/glib/-/issues/2319.
+ *
+ * Returns: (nullable): a pointer to the newly-allocated copy of the memory,
+ * or %NULL if @mem is %NULL.
+ */
+static inline gpointer g_memdup2_qemu(gconstpointer mem, gsize byte_size)
+{
+#if GLIB_CHECK_VERSION(2, 68, 0)
+ return g_memdup2(mem, byte_size);
+#else
+ gpointer new_mem;
+
+ if (mem && byte_size != 0) {
+ new_mem = g_malloc(byte_size);
+ memcpy(new_mem, mem, byte_size);
+ } else {
+ new_mem = NULL;
+ }
+
+ return new_mem;
+#endif
+}
+#define g_memdup2(a) g_memdup2_qemu(a)
+
#if defined(G_OS_UNIX)
/*
* Note: The fallback implementation is not MT-safe, and it returns a copy of
--
2.31.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH v2 00/30] glib: Replace g_memdup() by g_memdup2()
2021-09-03 17:39 [PATCH v2 00/30] glib: Replace g_memdup() by g_memdup2() Philippe Mathieu-Daudé
2021-09-03 17:39 ` [PATCH v2 01/30] hw/hyperv/vmbus: Remove unused vmbus_load/save_req() Philippe Mathieu-Daudé
2021-09-03 17:39 ` [PATCH v2 02/30] glib-compat: Introduce g_memdup2() wrapper Philippe Mathieu-Daudé
@ 2021-09-03 17:43 ` Philippe Mathieu-Daudé
2 siblings, 0 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-09-03 17:43 UTC (permalink / raw)
To: qemu-devel
Cc: Fam Zheng, Peter Maydell, Michael S. Tsirkin, Jason Wang,
Christian Schoenebeck, Gerd Hoffmann, Eric Blake, qemu-block,
John Snow, David Hildenbrand, Markus Armbruster, Laurent Vivier,
Thomas Huth, Eduardo Habkost, Richard Henderson, Alex Williamson,
qemu-arm, Alex Bennée, David Gibson, Kevin Wolf,
Vladimir Sementsov-Ogievskiy, Daniel P . Berrange, Hanna Reitz,
qemu-ppc, Paolo Bonzini
On 9/3/21 7:39 PM, Philippe Mathieu-Daudé wrote:
> Per https://discourse.gnome.org/t/port-your-module-from-g-memdup-to-g-memdup2-now/5538
>
> The old API took the size of the memory to duplicate as a guint,
> whereas most memory functions take memory sizes as a gsize. This
> made it easy to accidentally pass a gsize to g_memdup(). For large
> values, that would lead to a silent truncation of the size from 64
> to 32 bits, and result in a heap area being returned which is
> significantly smaller than what the caller expects. This can likely
> be exploited in various modules to cause a heap buffer overflow.
>
> g_memdup() as been deprecated in GLib 2.68. Since QEMU defines
> GLIB_VERSION_MAX_ALLOWED to GLIB_VERSION_2_56, the deprecation
> is not displayed (on GLib >= 2.68 such available on Fedora 34).
> However the function is still unsafe, so it is better to avoid
> its use.
>
> This series provides the safely equivalent g_memdup2() wrapper,
> and replace all g_memdup() calls by it.
>
> The previous link recommend to audit the call sites. Most of the
> calls use byte_size=sizeof(STRUCT), and no STRUCT appears to be
>> 4GiB. Few calls use unsigned/size_t/uint16_t. Where code is
> doing multiplication, patches are sent as RFC. In particular:
> hw/net/virtio-net.c
> hw/virtio/virtio-crypto.c
>
> Since v1:
> - Added missing g_memdup2 -> g_memdup2_qemu compat definition (danpb)
> - Do not call g_memdup2_qemu() but directly g_memdup2() (danpb)
>
> Philippe Mathieu-Daudé (30):
> hw/hyperv/vmbus: Remove unused vmbus_load/save_req()
> glib-compat: Introduce g_memdup2() wrapper
> qapi: Replace g_memdup() by g_memdup2()
> accel/tcg: Replace g_memdup() by g_memdup2()
> block/qcow2-bitmap: Replace g_memdup() by g_memdup2()
> softmmu: Replace g_memdup() by g_memdup2()
> hw/9pfs: Replace g_memdup() by g_memdup2()
> hw/acpi: Avoid truncating acpi_data_len() to 32-bit
> hw/acpi: Replace g_memdup() by g_memdup2()
> hw/core/machine: Replace g_memdup() by g_memdup2()
> hw/hppa/machine: Replace g_memdup() by g_memdup2()
> hw/i386/multiboot: Replace g_memdup() by g_memdup2()
> hw/net/eepro100: Replace g_memdup() by g_memdup2()
> hw/nvram/fw_cfg: Replace g_memdup() by g_memdup2()
> hw/scsi/mptsas: Replace g_memdup() by g_memdup2()
> hw/ppc/spapr_pci: Replace g_memdup() by g_memdup2()
> hw/rdma: Replace g_memdup() by g_memdup2()
> hw/vfio/pci: Replace g_memdup() by g_memdup2()
> RFC hw/virtio: Replace g_memdup() by g_memdup2()
> net/colo: Replace g_memdup() by g_memdup2()
> RFC ui/clipboard: Replace g_memdup() by g_memdup2()
> RFC linux-user: Replace g_memdup() by g_memdup2()
> tests/unit: Replace g_memdup() by g_memdup2()
> tests/qtest: Replace g_memdup() by g_memdup2()
> target/arm: Replace g_memdup() by g_memdup2()
> target/ppc: Replace g_memdup() by g_memdup2()
> contrib: Replace g_memdup() by g_memdup2()
> checkpatch: Do not allow deprecated g_memdup()
> f
> test
I figured too late I was not placed in the correct commit,
please disregard this incomplete series...
^ permalink raw reply [flat|nested] 4+ messages in thread