[0/2] hw/scsi/scsi-disk: Avoid buffer overrun parsing loadparam (CID 1565746)

Message ID	20241120085300.49866-1-philmd@linaro.org
Headers	show Delivered-To: patch@linaro.org Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <philmd@linaro.org> To: qemu-devel@nongnu.org Cc: qemu-s390x@nongnu.org, David Hildenbrand <david@redhat.com>, Halil Pasic <pasic@linux.ibm.com>, Christian Borntraeger <borntraeger@linux.ibm.com>, Eric Farman <farman@linux.ibm.com>, Thomas Huth <thuth@redhat.com>, Jared Rossi <jrossi@linux.ibm.com>, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <philmd@linaro.org> Subject: [PATCH 0/2] hw/scsi/scsi-disk: Avoid buffer overrun parsing loadparam (CID 1565746) Date: Wed, 20 Nov 2024 09:52:58 +0100 Message-ID: <20241120085300.49866-1-philmd@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2a00:1450:4864:20::335; envelope-from=philmd@linaro.org; helo=mail-wm1-x335.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action Precedence: list Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org
Series	hw/scsi/scsi-disk: Avoid buffer overrun parsing loadparam (CID 1565746) \| expand [0/2] hw/scsi/scsi-disk: Avoid buffer overrun parsing loadparam (CID 1565746) [1/2] hw/s390x: Declare loadparm as char[LOADPARM_LEN] [2/2] hw/scsi/scsi-disk: Avoid buffer overrun parsing 'loadparam'

Message ID

20241120085300.49866-1-philmd@linaro.org

Headers

Received-SPF: pass (google.com: domain of
 qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as
 permitted sender) client-ip=209.51.188.17;
From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <philmd@linaro.org>
To: qemu-devel@nongnu.org
Cc: qemu-s390x@nongnu.org, David Hildenbrand <david@redhat.com>,
 Halil Pasic <pasic@linux.ibm.com>,
 Christian Borntraeger <borntraeger@linux.ibm.com>,
 Eric Farman <farman@linux.ibm.com>, Thomas Huth <thuth@redhat.com>,
 Jared Rossi <jrossi@linux.ibm.com>,
 =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Subject: [PATCH 0/2] hw/scsi/scsi-disk: Avoid buffer overrun parsing loadparam
 (CID 1565746)
Date: Wed, 20 Nov 2024 09:52:58 +0100
Message-ID: <20241120085300.49866-1-philmd@linaro.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Received-SPF: pass client-ip=2a00:1450:4864:20::335;
 envelope-from=philmd@linaro.org; helo=mail-wm1-x335.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no
X-Spam_action: no action
X-BeenThere: qemu-devel@nongnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
 <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <https://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
 <mailto:qemu-devel-request@nongnu.org?subject=subscribe>
Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org
Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org

Series

hw/scsi/scsi-disk: Avoid buffer overrun parsing loadparam (CID 1565746) | expand

Message

Philippe Mathieu-Daudé Nov. 20, 2024, 8:52 a.m. UTC

Replace magic 8 by proper LOADPARM_LEN definition,
use array of char, allocate loadparam[] within qdev
state, fixing Coverity overrun report (CID 1565746).

Philippe Mathieu-Daudé (2):
  hw/s390x: Declare loadparm as char[LOADPARM_LEN]
  hw/scsi/scsi-disk: Avoid buffer overrun parsing 'loadparam'

 hw/s390x/ccw-device.h               |  5 +++--
 hw/s390x/ipl.h                      |  2 +-
 include/hw/qdev-properties-system.h |  2 +-
 include/hw/s390x/s390-virtio-ccw.h  |  3 ++-
 hw/core/qdev-properties-system.c    |  8 +++++---
 hw/s390x/ipl.c                      |  6 +++---
 hw/scsi/scsi-disk.c                 | 12 +++---------
 7 files changed, 18 insertions(+), 20 deletions(-)