qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: "Cédric Le Goater" <clg@redhat.com>
To: qemu-devel@nongnu.org
Cc: "Stefan Hajnoczi" <stefanha@redhat.com>,
	"Denis V . Lunev" <den@openvz.org>,
	"Kevin Wolf" <kwolf@redhat.com>,
	"Hanna Reitz" <hreitz@redhat.com>, "Stefan Weil" <sw@weilnetz.de>,
	"Paolo Bonzini" <pbonzini@redhat.com>,
	"Daniel P . Berrangé" <berrange@redhat.com>,
	"Eduardo Habkost" <eduardo@habkost.net>,
	"Maciej S . Szmigiero" <maciej.szmigiero@oracle.com>,
	"Fam Zheng" <fam@euphon.net>,
	"Juan Quintela" <quintela@redhat.com>,
	"Peter Xu" <peterx@redhat.com>, "Fabiano Rosas" <farosas@suse.de>,
	"Leonardo Bras" <leobras@redhat.com>,
	"Cédric Le Goater" <clg@redhat.com>,
	"Alex Williamson" <alex.williamson@redhat.com>
Subject: [PATCH v2 2/3] vfio/pci: Fix buffer overrun when writing the VF token
Date: Thu, 26 Oct 2023 09:06:35 +0200	[thread overview]
Message-ID: <20231026070636.1165037-3-clg@redhat.com> (raw)
In-Reply-To: <20231026070636.1165037-1-clg@redhat.com>

qemu_uuid_unparse() includes a trailing NUL when writing the uuid
string and the buffer size should be UUID_FMT_LEN + 1 bytes. Use the
recently added UUID_STR_LEN which defines the correct size.

Fixes: CID 1522913
Fixes: 2dca1b37a760 ("vfio/pci: add support for VF token")
Cc: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 9bfa83aca1a87952e18743c9ca951b1bfc873507..c02a5d70f5e1b8e4d22051285748f514f1b9f008 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3274,7 +3274,7 @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
     Error *err = NULL;
     int i, ret;
     bool is_mdev;
-    char uuid[UUID_FMT_LEN];
+    char uuid[UUID_STR_LEN];
     char *name;
 
     if (vbasedev->fd < 0 && !vbasedev->sysfsdev) {
-- 
2.41.0



  parent reply	other threads:[~2023-10-26  7:08 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-10-26  7:06 [PATCH v2 0/3] vfio/pci: Fix buffer overrun when writing the VF token Cédric Le Goater
2023-10-26  7:06 ` [PATCH v2 1/3] util/uuid: Add UUID_STR_LEN definition Cédric Le Goater
2023-10-26  7:06 ` Cédric Le Goater [this message]
2023-10-26 11:28   ` [PATCH v2 2/3] vfio/pci: Fix buffer overrun when writing the VF token Peter Maydell
2023-10-26 13:33     ` Cédric Le Goater
2023-10-26  7:06 ` [PATCH v2 3/3] util/uuid: Remove UUID_FMT_LEN Cédric Le Goater
2023-10-26  7:18   ` Philippe Mathieu-Daudé
2023-10-26 10:57   ` Juan Quintela
2023-10-26  8:41 ` [PATCH v2 0/3] vfio/pci: Fix buffer overrun when writing the VF token Denis V. Lunev
2023-10-26  9:58   ` Cédric Le Goater
2023-10-26 13:42   ` Konstantin Ryabitsev
2023-10-26 15:36     ` Peter Maydell
2023-10-26 14:00 ` Cédric Le Goater
2023-10-27  5:01   ` Philippe Mathieu-Daudé
2023-10-30  8:59   ` Cédric Le Goater

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20231026070636.1165037-3-clg@redhat.com \
    --to=clg@redhat.com \
    --cc=alex.williamson@redhat.com \
    --cc=berrange@redhat.com \
    --cc=den@openvz.org \
    --cc=eduardo@habkost.net \
    --cc=fam@euphon.net \
    --cc=farosas@suse.de \
    --cc=hreitz@redhat.com \
    --cc=kwolf@redhat.com \
    --cc=leobras@redhat.com \
    --cc=maciej.szmigiero@oracle.com \
    --cc=pbonzini@redhat.com \
    --cc=peterx@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=quintela@redhat.com \
    --cc=stefanha@redhat.com \
    --cc=sw@weilnetz.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).