[Qemu-devel] valgrind problem in sun4u_load_kernel()

[Qemu-devel] valgrind problem in sun4u_load_kernel()

[Thomas Huth]

 Hi Mark, hi Artyom,

while using valgrind to fix some issues with the rom_ptr() function
today, I noticed that there is one more problem in sun4u_load_kernel():
The kernel_top variable can be used uninitialized in some cases:
If load_elf() fails and the kernel is loaded via load_aout() or
load_image_targphys(), the kernel_top variable is never set to a valid
value. This could cause some trouble when loading the initrd later. When
you've got some spare time, could you please have a look?

 Thanks,
  Thomas

Re: [Qemu-devel] valgrind problem in sun4u_load_kernel()

[Mark Cave-Ayland]

On 15/06/18 11:37, Thomas Huth wrote:

>   Hi Mark, hi Artyom,
> 
> while using valgrind to fix some issues with the rom_ptr() function
> today, I noticed that there is one more problem in sun4u_load_kernel():
> The kernel_top variable can be used uninitialized in some cases:
> If load_elf() fails and the kernel is loaded via load_aout() or
> load_image_targphys(), the kernel_top variable is never set to a valid
> value. This could cause some trouble when loading the initrd later. When
> you've got some spare time, could you please have a look?

Hmmm that's an interesting one - I'm not immediately aware of any 64-bit 
kernels that are a.out rather than ELF, so I wonder if this has been 
used to run a.out executables on startup? Any thoughts, Artyom?

If this is the case then we can only have a valid kernel_top with an ELF 
kernel then maybe the following is a good enough solution:


diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index 3975a7b65a..35acf8c96e 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -139,7 +139,7 @@ static uint64_t sun4u_load_kernel(const char 
*kernel_filename,
      unsigned int i;
      long kernel_size;
      uint8_t *ptr;
-    uint64_t kernel_top;
+    uint64_t kernel_top = 0;

      linux_boot = (kernel_filename != NULL);

@@ -172,7 +172,7 @@ static uint64_t sun4u_load_kernel(const char 
*kernel_filename,
          }
          /* load initrd above kernel */
          *initrd_size = 0;
-        if (initrd_filename) {
+        if (initrd_filename && kernel_top) {
              *initrd_addr = TARGET_PAGE_ALIGN(kernel_top);

              *initrd_size = load_image_targphys(initrd_filename,


ATB,

Mark.

Re: [Qemu-devel] valgrind problem in sun4u_load_kernel()

[Artyom Tarasenko]

On Sun, Jun 17, 2018 at 12:22 PM, Mark Cave-Ayland
<mark.cave-ayland@ilande.co.uk> wrote:
> On 15/06/18 11:37, Thomas Huth wrote:
>
>>   Hi Mark, hi Artyom,
>>
>> while using valgrind to fix some issues with the rom_ptr() function
>> today, I noticed that there is one more problem in sun4u_load_kernel():
>> The kernel_top variable can be used uninitialized in some cases:
>> If load_elf() fails and the kernel is loaded via load_aout() or
>> load_image_targphys(), the kernel_top variable is never set to a valid
>> value. This could cause some trouble when loading the initrd later. When
>> you've got some spare time, could you please have a look?
>
>
> Hmmm that's an interesting one - I'm not immediately aware of any 64-bit
> kernels that are a.out rather than ELF, so I wonder if this has been used to
> run a.out executables on startup? Any thoughts, Artyom?

I think there are no Linux/SPARC64 kernels in the a.out format.
NetBSD should not be a problem either

> If this is the case then we can only have a valid kernel_top with an ELF
> kernel then maybe the following is a good enough solution:
>
>
> diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
> index 3975a7b65a..35acf8c96e 100644
> --- a/hw/sparc64/sun4u.c
> +++ b/hw/sparc64/sun4u.c
> @@ -139,7 +139,7 @@ static uint64_t sun4u_load_kernel(const char
> *kernel_filename,
>      unsigned int i;
>      long kernel_size;
>      uint8_t *ptr;
> -    uint64_t kernel_top;
> +    uint64_t kernel_top = 0;
>
>      linux_boot = (kernel_filename != NULL);
>
> @@ -172,7 +172,7 @@ static uint64_t sun4u_load_kernel(const char
> *kernel_filename,
>          }
>          /* load initrd above kernel */
>          *initrd_size = 0;
> -        if (initrd_filename) {
> +        if (initrd_filename && kernel_top) {
>              *initrd_addr = TARGET_PAGE_ALIGN(kernel_top);
>
>              *initrd_size = load_image_targphys(initrd_filename,
>
>
Looks good to me.
Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>


-- 
Regards,
Artyom Tarasenko

SPARC and PPC PReP under qemu blog: http://tyom.blogspot.com/search/label/qemu

Re: [Qemu-devel] valgrind problem in sun4u_load_kernel()

[Thomas Huth]

On 06/19/2018 10:03 AM, Artyom Tarasenko wrote:
> On Sun, Jun 17, 2018 at 12:22 PM, Mark Cave-Ayland
> <mark.cave-ayland@ilande.co.uk> wrote:
>> On 15/06/18 11:37, Thomas Huth wrote:
>>
>>>   Hi Mark, hi Artyom,
>>>
>>> while using valgrind to fix some issues with the rom_ptr() function
>>> today, I noticed that there is one more problem in sun4u_load_kernel():
>>> The kernel_top variable can be used uninitialized in some cases:
>>> If load_elf() fails and the kernel is loaded via load_aout() or
>>> load_image_targphys(), the kernel_top variable is never set to a valid
>>> value. This could cause some trouble when loading the initrd later. When
>>> you've got some spare time, could you please have a look?
>>
>>
>> Hmmm that's an interesting one - I'm not immediately aware of any 64-bit
>> kernels that are a.out rather than ELF, so I wonder if this has been used to
>> run a.out executables on startup? Any thoughts, Artyom?
> 
> I think there are no Linux/SPARC64 kernels in the a.out format.
> NetBSD should not be a problem either
> 
>> If this is the case then we can only have a valid kernel_top with an ELF
>> kernel then maybe the following is a good enough solution:
>>
>>
>> diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
>> index 3975a7b65a..35acf8c96e 100644
>> --- a/hw/sparc64/sun4u.c
>> +++ b/hw/sparc64/sun4u.c
>> @@ -139,7 +139,7 @@ static uint64_t sun4u_load_kernel(const char
>> *kernel_filename,
>>      unsigned int i;
>>      long kernel_size;
>>      uint8_t *ptr;
>> -    uint64_t kernel_top;
>> +    uint64_t kernel_top = 0;
>>
>>      linux_boot = (kernel_filename != NULL);
>>
>> @@ -172,7 +172,7 @@ static uint64_t sun4u_load_kernel(const char
>> *kernel_filename,
>>          }
>>          /* load initrd above kernel */
>>          *initrd_size = 0;
>> -        if (initrd_filename) {
>> +        if (initrd_filename && kernel_top) {
>>              *initrd_addr = TARGET_PAGE_ALIGN(kernel_top);
>>
>>              *initrd_size = load_image_targphys(initrd_filename,
>>
>>
> Looks good to me.
> Acked-by: Artyom Tarasenko <atar4qemu@gmail.com>

 Hi Mark,

that looked also fine to me. Could you post it as a proper patch, please?

 Thanks,
  Thomas