* [PATCH] scsi: Silence gcc warning
@ 2021-02-09 15:23 Eric Blake
2021-02-09 15:44 ` Philippe Mathieu-Daudé
0 siblings, 1 reply; 4+ messages in thread
From: Eric Blake @ 2021-02-09 15:23 UTC (permalink / raw)
To: qemu-devel; +Cc: Fam Zheng, Paolo Bonzini
On Fedora 33, gcc 10.2.1 notes that scsi_cdb_length(buf) can set
len==-1, which in turn overflows g_malloc():
[5/5] Linking target qemu-system-x86_64
In function ‘scsi_disk_new_request_dump’,
inlined from ‘scsi_new_request’ at ../hw/scsi/scsi-disk.c:2608:9:
../hw/scsi/scsi-disk.c:2582:19: warning: argument 1 value ‘18446744073709551612’ exceeds maximum object size 9223372036854775807 [-Walloc-size-larger-than=]
2582 | line_buffer = g_malloc(len * 5 + 1);
| ^
Silence it with a decent assertion, since we only convert a buffer to
bytes when we have a valid cdb length.
Signed-off-by: Eric Blake <eblake@redhat.com>
---
hw/scsi/scsi-disk.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index ed52fcd49ff0..b3311a5657b7 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -2579,6 +2579,7 @@ static void scsi_disk_new_request_dump(uint32_t lun, uint32_t tag, uint8_t *buf)
int len = scsi_cdb_length(buf);
char *line_buffer, *p;
+ assert(len > 0 && len <= 16);
line_buffer = g_malloc(len * 5 + 1);
for (i = 0, p = line_buffer; i < len; i++) {
--
2.30.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] scsi: Silence gcc warning
2021-02-09 15:23 [PATCH] scsi: Silence gcc warning Eric Blake
@ 2021-02-09 15:44 ` Philippe Mathieu-Daudé
2021-03-08 19:54 ` Eric Blake
0 siblings, 1 reply; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2021-02-09 15:44 UTC (permalink / raw)
To: Eric Blake, qemu-devel, Li Qiang, Alexander Bulekov
Cc: Fam Zheng, Paolo Bonzini
On 2/9/21 4:23 PM, Eric Blake wrote:
> On Fedora 33, gcc 10.2.1 notes that scsi_cdb_length(buf) can set
> len==-1, which in turn overflows g_malloc():
>
> [5/5] Linking target qemu-system-x86_64
> In function ‘scsi_disk_new_request_dump’,
> inlined from ‘scsi_new_request’ at ../hw/scsi/scsi-disk.c:2608:9:
> ../hw/scsi/scsi-disk.c:2582:19: warning: argument 1 value ‘18446744073709551612’ exceeds maximum object size 9223372036854775807 [-Walloc-size-larger-than=]
> 2582 | line_buffer = g_malloc(len * 5 + 1);
> | ^
>
> Silence it with a decent assertion, since we only convert a buffer to
> bytes when we have a valid cdb length.
>
> Signed-off-by: Eric Blake <eblake@redhat.com>
> ---
> hw/scsi/scsi-disk.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
> index ed52fcd49ff0..b3311a5657b7 100644
> --- a/hw/scsi/scsi-disk.c
> +++ b/hw/scsi/scsi-disk.c
> @@ -2579,6 +2579,7 @@ static void scsi_disk_new_request_dump(uint32_t lun, uint32_t tag, uint8_t *buf)
> int len = scsi_cdb_length(buf);
> char *line_buffer, *p;
>
> + assert(len > 0 && len <= 16);
> line_buffer = g_malloc(len * 5 + 1);
>
> for (i = 0, p = line_buffer; i < len; i++) {
>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] scsi: Silence gcc warning
2021-02-09 15:44 ` Philippe Mathieu-Daudé
@ 2021-03-08 19:54 ` Eric Blake
2021-03-09 20:22 ` Laurent Vivier
0 siblings, 1 reply; 4+ messages in thread
From: Eric Blake @ 2021-03-08 19:54 UTC (permalink / raw)
To: Philippe Mathieu-Daudé, qemu-devel, Li Qiang,
Alexander Bulekov, qemu-trivial@nongnu.org
Cc: Fam Zheng, Paolo Bonzini
Adding qemu-trivial in cc.
On 2/9/21 9:44 AM, Philippe Mathieu-Daudé wrote:
> On 2/9/21 4:23 PM, Eric Blake wrote:
>> On Fedora 33, gcc 10.2.1 notes that scsi_cdb_length(buf) can set
>> len==-1, which in turn overflows g_malloc():
>>
>> [5/5] Linking target qemu-system-x86_64
>> In function ‘scsi_disk_new_request_dump’,
>> inlined from ‘scsi_new_request’ at ../hw/scsi/scsi-disk.c:2608:9:
>> ../hw/scsi/scsi-disk.c:2582:19: warning: argument 1 value ‘18446744073709551612’ exceeds maximum object size 9223372036854775807 [-Walloc-size-larger-than=]
>> 2582 | line_buffer = g_malloc(len * 5 + 1);
>> | ^
>>
>> Silence it with a decent assertion, since we only convert a buffer to
>> bytes when we have a valid cdb length.
>>
>> Signed-off-by: Eric Blake <eblake@redhat.com>
>> ---
>> hw/scsi/scsi-disk.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
>> index ed52fcd49ff0..b3311a5657b7 100644
>> --- a/hw/scsi/scsi-disk.c
>> +++ b/hw/scsi/scsi-disk.c
>> @@ -2579,6 +2579,7 @@ static void scsi_disk_new_request_dump(uint32_t lun, uint32_t tag, uint8_t *buf)
>> int len = scsi_cdb_length(buf);
>> char *line_buffer, *p;
>>
>> + assert(len > 0 && len <= 16);
>> line_buffer = g_malloc(len * 5 + 1);
>>
>> for (i = 0, p = line_buffer; i < len; i++) {
>>
>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
>
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3226
Virtualization: qemu.org | libvirt.org
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] scsi: Silence gcc warning
2021-03-08 19:54 ` Eric Blake
@ 2021-03-09 20:22 ` Laurent Vivier
0 siblings, 0 replies; 4+ messages in thread
From: Laurent Vivier @ 2021-03-09 20:22 UTC (permalink / raw)
To: Eric Blake, Philippe Mathieu-Daudé, qemu-devel, Li Qiang,
Alexander Bulekov, qemu-trivial@nongnu.org
Cc: Fam Zheng, Paolo Bonzini
Le 08/03/2021 à 20:54, Eric Blake a écrit :
> Adding qemu-trivial in cc.
>
> On 2/9/21 9:44 AM, Philippe Mathieu-Daudé wrote:
>> On 2/9/21 4:23 PM, Eric Blake wrote:
>>> On Fedora 33, gcc 10.2.1 notes that scsi_cdb_length(buf) can set
>>> len==-1, which in turn overflows g_malloc():
>>>
>>> [5/5] Linking target qemu-system-x86_64
>>> In function ‘scsi_disk_new_request_dump’,
>>> inlined from ‘scsi_new_request’ at ../hw/scsi/scsi-disk.c:2608:9:
>>> ../hw/scsi/scsi-disk.c:2582:19: warning: argument 1 value ‘18446744073709551612’ exceeds maximum object size 9223372036854775807 [-Walloc-size-larger-than=]
>>> 2582 | line_buffer = g_malloc(len * 5 + 1);
>>> | ^
>>>
>>> Silence it with a decent assertion, since we only convert a buffer to
>>> bytes when we have a valid cdb length.
>>>
>>> Signed-off-by: Eric Blake <eblake@redhat.com>
>>> ---
>>> hw/scsi/scsi-disk.c | 1 +
>>> 1 file changed, 1 insertion(+)
>>>
>>> diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
>>> index ed52fcd49ff0..b3311a5657b7 100644
>>> --- a/hw/scsi/scsi-disk.c
>>> +++ b/hw/scsi/scsi-disk.c
>>> @@ -2579,6 +2579,7 @@ static void scsi_disk_new_request_dump(uint32_t lun, uint32_t tag, uint8_t *buf)
>>> int len = scsi_cdb_length(buf);
>>> char *line_buffer, *p;
>>>
>>> + assert(len > 0 && len <= 16);
>>> line_buffer = g_malloc(len * 5 + 1);
>>>
>>> for (i = 0, p = line_buffer; i < len; i++) {
>>>
>>
>> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
>>
>
Applied to my trivial-patches branch.
Thanks,
Laurent
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-03-09 20:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-02-09 15:23 [PATCH] scsi: Silence gcc warning Eric Blake
2021-02-09 15:44 ` Philippe Mathieu-Daudé
2021-03-08 19:54 ` Eric Blake
2021-03-09 20:22 ` Laurent Vivier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).