* [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity
@ 2016-08-22 12:47 Wei Liu
2016-08-22 12:47 ` [PATCH v2 1/2] hvmloader: correctly copy signature to info structures Wei Liu
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Wei Liu @ 2016-08-22 12:47 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Wei Liu, Jan Beulich
Wei Liu (2):
hvmloader: correctly copy signature to info structures
hvmloader: use bound checking in get_module_entry
tools/firmware/hvmloader/hvmloader.c | 4 ++--
tools/firmware/hvmloader/ovmf.c | 8 ++++----
tools/firmware/hvmloader/seabios.c | 8 ++++----
3 files changed, 10 insertions(+), 10 deletions(-)
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 1/2] hvmloader: correctly copy signature to info structures
2016-08-22 12:47 [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
@ 2016-08-22 12:47 ` Wei Liu
2016-08-22 12:53 ` Jan Beulich
2016-08-22 12:47 ` [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry Wei Liu
2016-08-22 13:21 ` [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
2 siblings, 1 reply; 6+ messages in thread
From: Wei Liu @ 2016-08-22 12:47 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Wei Liu, Jan Beulich
The original code used sizeof(info->signature) as the size parameter for
memcpy, which was wrong.
Fix that by using structure assignment.
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
---
tools/firmware/hvmloader/ovmf.c | 8 ++++----
tools/firmware/hvmloader/seabios.c | 8 ++++----
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/tools/firmware/hvmloader/ovmf.c b/tools/firmware/hvmloader/ovmf.c
index b4bcc93..0ac3416 100644
--- a/tools/firmware/hvmloader/ovmf.c
+++ b/tools/firmware/hvmloader/ovmf.c
@@ -68,10 +68,10 @@ static void ovmf_setup_bios_info(void)
{
struct ovmf_info *info = (void *)OVMF_INFO_PHYSICAL_ADDRESS;
- memset(info, 0, sizeof(*info));
-
- memcpy(info->signature, "XenHVMOVMF", sizeof(info->signature));
- info->length = sizeof(*info);
+ *info = (struct ovmf_info) {
+ .signature = "XenHVMOVMF",
+ .length = sizeof(*info)
+ };
}
static void ovmf_finish_bios_info(void)
diff --git a/tools/firmware/hvmloader/seabios.c b/tools/firmware/hvmloader/seabios.c
index 5c9a351..44ff0d7 100644
--- a/tools/firmware/hvmloader/seabios.c
+++ b/tools/firmware/hvmloader/seabios.c
@@ -56,10 +56,10 @@ static void seabios_setup_bios_info(void)
{
struct seabios_info *info = (void *)BIOS_INFO_PHYSICAL_ADDRESS;
- memset(info, 0, sizeof(*info));
-
- memcpy(info->signature, "XenHVMSeaBIOS", sizeof(info->signature));
- info->length = sizeof(*info);
+ *info = (struct seabios_info) {
+ .signature = "XenHVMSeaBIOS",
+ .length = sizeof(*info)
+ };
info->tables = (uint32_t)scratch_alloc(MAX_TABLES*sizeof(uint32_t), 0);
}
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry
2016-08-22 12:47 [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
2016-08-22 12:47 ` [PATCH v2 1/2] hvmloader: correctly copy signature to info structures Wei Liu
@ 2016-08-22 12:47 ` Wei Liu
2016-08-22 12:54 ` Jan Beulich
2016-08-22 13:21 ` [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
2 siblings, 1 reply; 6+ messages in thread
From: Wei Liu @ 2016-08-22 12:47 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Wei Liu, Jan Beulich
Coverity complains:
overflow_before_widen: Potentially overflowing expression
info->nr_modules * 32U with type unsigned int (32 bits, unsigned) is
evaluated using 32-bit arithmetic, and then used in a context that
expects an expression of type uint64_t (64 bits, unsigned).
The overflow is unlikely to happen in reality because we only expect a
few modules.
Fix that by converting the check to use bound checking to placate
Coverity.
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
---
tools/firmware/hvmloader/hvmloader.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/firmware/hvmloader/hvmloader.c b/tools/firmware/hvmloader/hvmloader.c
index 7b32d86..bbd4e34 100644
--- a/tools/firmware/hvmloader/hvmloader.c
+++ b/tools/firmware/hvmloader/hvmloader.c
@@ -272,8 +272,8 @@ const struct hvm_modlist_entry *get_module_entry(
if ( !modlist ||
info->modlist_paddr > UINTPTR_MAX ||
- (info->modlist_paddr + info->nr_modules * sizeof(*modlist) - 1)
- > UINTPTR_MAX )
+ (UINTPTR_MAX - (uintptr_t)info->modlist_paddr) / sizeof(*modlist)
+ < info->nr_modules )
return NULL;
for ( i = 0; i < info->nr_modules; i++ )
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2 1/2] hvmloader: correctly copy signature to info structures
2016-08-22 12:47 ` [PATCH v2 1/2] hvmloader: correctly copy signature to info structures Wei Liu
@ 2016-08-22 12:53 ` Jan Beulich
0 siblings, 0 replies; 6+ messages in thread
From: Jan Beulich @ 2016-08-22 12:53 UTC (permalink / raw)
To: Wei Liu; +Cc: Andrew Cooper, Xen-devel
>>> On 22.08.16 at 14:47, <wei.liu2@citrix.com> wrote:
> The original code used sizeof(info->signature) as the size parameter for
> memcpy, which was wrong.
>
> Fix that by using structure assignment.
>
> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry
2016-08-22 12:47 ` [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry Wei Liu
@ 2016-08-22 12:54 ` Jan Beulich
0 siblings, 0 replies; 6+ messages in thread
From: Jan Beulich @ 2016-08-22 12:54 UTC (permalink / raw)
To: Wei Liu; +Cc: Andrew Cooper, Xen-devel
>>> On 22.08.16 at 14:47, <wei.liu2@citrix.com> wrote:
> Coverity complains:
>
> overflow_before_widen: Potentially overflowing expression
> info->nr_modules * 32U with type unsigned int (32 bits, unsigned) is
> evaluated using 32-bit arithmetic, and then used in a context that
> expects an expression of type uint64_t (64 bits, unsigned).
>
> The overflow is unlikely to happen in reality because we only expect a
> few modules.
>
> Fix that by converting the check to use bound checking to placate
> Coverity.
>
> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity
2016-08-22 12:47 [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
2016-08-22 12:47 ` [PATCH v2 1/2] hvmloader: correctly copy signature to info structures Wei Liu
2016-08-22 12:47 ` [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry Wei Liu
@ 2016-08-22 13:21 ` Wei Liu
2 siblings, 0 replies; 6+ messages in thread
From: Wei Liu @ 2016-08-22 13:21 UTC (permalink / raw)
To: Xen-devel; +Cc: Andrew Cooper, Wei Liu, Jan Beulich
On Mon, Aug 22, 2016 at 01:47:51PM +0100, Wei Liu wrote:
> Wei Liu (2):
> hvmloader: correctly copy signature to info structures
> hvmloader: use bound checking in get_module_entry
>
Pushed.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-08-22 13:21 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-08-22 12:47 [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
2016-08-22 12:47 ` [PATCH v2 1/2] hvmloader: correctly copy signature to info structures Wei Liu
2016-08-22 12:53 ` Jan Beulich
2016-08-22 12:47 ` [PATCH v2 2/2] hvmloader: use bound checking in get_module_entry Wei Liu
2016-08-22 12:54 ` Jan Beulich
2016-08-22 13:21 ` [PATCH v2 0/2] hvmloader: fix two issues spotted by Coverity Wei Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).