From patchwork Thu Aug 24 15:32:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 716550 Delivered-To: patch@linaro.org Received: by 2002:adf:f747:0:b0:317:ecd7:513f with SMTP id z7csp1409049wrp; Thu, 24 Aug 2023 08:34:30 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHeKZ/HjzZDSPj8tC35Ykzea3PWY3Gya5gD21kVH2PQ9FCkmAjMTQV4nkKILMeIQi4E31Fb X-Received: by 2002:a0c:b2c6:0:b0:64a:b025:6a6 with SMTP id d6-20020a0cb2c6000000b0064ab02506a6mr16086766qvf.18.1692891270367; Thu, 24 Aug 2023 08:34:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692891270; cv=none; d=google.com; s=arc-20160816; b=F+2FoMysX1c87XIQxNYF/dnaryWM93PcZ1ftxB824CHy9wfOrwBKarjhM+WzmRwA9T XDzbBFm+XOw9P4H2Ix80tfjl+AfHMR/50nayEN/nU2WPsM4cWTa65EXShyrGuYFDL3Ml U8Bet8EKmx0paYAEPjLRfbpJNp+s2ciuNd+dnCPtWsxd/bGWI47PvqLzsJ5W+q99x0Ei sHvWFaLadzinYERquov01riqVLpBFIxOXcQN5+CVE+IjFKTdD7YrfuuzW0UcXCh3LB3M YLs++1kewyTu4i9c88sh/q0TAgMZiA1BhnOTGpIOXt8mpRekrHC9a+PD+z5T689RHrbl UzaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=+p4+7OBfarchATd3tFruYfwM1HUum7CKIwxdMycnIKM=; fh=Z0x2Ey7gOsdpGu+VySi/dy0yVHR+oF2A4NjMARJ+yfE=; b=IKx0v8EnDXFzoP970DlPfzJeauO6puE34iwOBc50nA7ihu+XGHHuOQowTi4YsiEUmi 59f4DhlBaQeOW6PLrBMWnbB+Uk0GAxD1D5xUNPUsZS11BRKif7+OGLVKtTJV0PZq3LA3 gN0jWTUwclCnaCpOkmB8JmZpP55BgzOvAU7S88sHwL8i/ygzhu5l502bAzTTUHp34Zxa 0b7KizJ5Ox9L+jFZrrRPkpS3tz+RL5WI0mB6FfVFi8PFUUDyV2ybA6oQoI5qOQi29HU0 k7sEmXHLweNMr/wDaJ4CXzn9yG1h2BoPdqnmFruS1ahYczLY50cFoTFiVUG5B3q6ftLN IS4w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=rjEdiZuv; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id k6-20020a0cabc6000000b00649a1768b24si8390789qvb.466.2023.08.24.08.34.30 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 24 Aug 2023 08:34:30 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=rjEdiZuv; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qZCKH-0001TM-Ix; Thu, 24 Aug 2023 11:32:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qZCK0-0001Qd-PT for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: from mail-wr1-x432.google.com ([2a00:1450:4864:20::432]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qZCJw-0003RK-6i for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: by mail-wr1-x432.google.com with SMTP id ffacd0b85a97d-31c5327e5e8so682439f8f.1 for ; Thu, 24 Aug 2023 08:32:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+p4+7OBfarchATd3tFruYfwM1HUum7CKIwxdMycnIKM=; b=rjEdiZuvlGmaAlCSjOgehf8AnR+PPGiHqtfxMBDODCEBuGswKVHLOipVpPHxJ1wQte 8nvGZTRf3fBY/SNRthg3Ti2ktm0/dgqWA6rLHyAr+2txhydN2pVP7+Hit2i9SVVzb0PX g65Si9hmz8Amk6DgGynJHYx/lE6VsUuIQycW7z2F+gyR72uzHppZOkaD+EdwrVzrHzJt Jk9n5aI4iAvSqdR7XFdVWSEn+6Ijh/s9zVK/lvtyrkdK2qu/OCWskAervwodVofONOKk JUUR/iYW4PrPOcRMmTz97FRPxupRh7G/Z5k+Bo9reN0s6YdBQ+ntT+/Q7POu8WeHwl80 7sDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=+p4+7OBfarchATd3tFruYfwM1HUum7CKIwxdMycnIKM=; b=iaJSPwx/8R4DwEcFN3PkrmzzEHNChD6ZcHMVV605SERSgtiQRVS/LzrgBzhUY53bXd GM1cOtLBNqdCStDcKpapJNr9kMDkzgsE6zUmBxCRXJq7vBUsjHfVikfZ2n/HneRrU6/z 0xqnj3vf4+8+HPWSjuoGroi9gCoI/tsZbix85vGeW8Er7Mlum1DsG4OCRC94jpkKMh+B i7vPe9aH/clnRw6CjbRoA+24rKrj893Vp6pkAQPgasg58N9tQH8dfUktBHfoszgxyxDS fbiK7uS0sLGf0Rg1ABqozdyBQFWEk2VG4NUGnND7e7fzcDapdgU/7D/gaDsw/cRaMMKb fPiA== X-Gm-Message-State: AOJu0Yx5seNI6aiN7Pof1riv/HRWSK1Ta3Cdg1/6WssqdUxlnorITVJq nxFSnKkR/+Njq8r+RUSFfxJHGiAcOgdoTD3fkjs= X-Received: by 2002:a5d:688a:0:b0:317:e68f:e1af with SMTP id h10-20020a5d688a000000b00317e68fe1afmr12101385wru.20.1692891146209; Thu, 24 Aug 2023 08:32:26 -0700 (PDT) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by smtp.gmail.com with ESMTPSA id x4-20020adff0c4000000b003180fdf5589sm22918640wro.6.2023.08.24.08.32.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 08:32:25 -0700 (PDT) From: Peter Maydell To: qemu-devel@nongnu.org Cc: Jason Wang , Jiri Pirko , qemu-ppc@nongnu.org Subject: [PATCH 1/4] hw/net/fsl_etsec/rings.c: Avoid variable length array Date: Thu, 24 Aug 2023 16:32:21 +0100 Message-Id: <20230824153224.2517486-2-peter.maydell@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230824153224.2517486-1-peter.maydell@linaro.org> References: <20230824153224.2517486-1-peter.maydell@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::432; envelope-from=peter.maydell@linaro.org; helo=mail-wr1-x432.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org In fill_rx_bd() we create a variable length array of size etsec->rx_padding. In fact we know that this will never be larger than 64 bytes, because rx_padding is set in rx_init_frame() in a way that ensures it is only that large. Use a fixed sized array and assert that it is big enough. Since padd[] is now potentially rather larger than the actual padding required, adjust the memset() we do on it to match the size that we write with cpu_physical_memory_write(), rather than clearing the entire array. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé --- hw/net/fsl_etsec/rings.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/hw/net/fsl_etsec/rings.c b/hw/net/fsl_etsec/rings.c index 788463f1b62..2f2f359f7a5 100644 --- a/hw/net/fsl_etsec/rings.c +++ b/hw/net/fsl_etsec/rings.c @@ -372,6 +372,12 @@ void etsec_walk_tx_ring(eTSEC *etsec, int ring_nbr) etsec->regs[TSTAT].value |= 1 << (31 - ring_nbr); } +/* + * rx_init_frame() ensures we never do more padding than this + * (checksum plus minimum data packet size) + */ +#define MAX_RX_PADDING 64 + static void fill_rx_bd(eTSEC *etsec, eTSEC_rxtx_bd *bd, const uint8_t **buf, @@ -380,9 +386,11 @@ static void fill_rx_bd(eTSEC *etsec, uint16_t to_write; hwaddr bufptr = bd->bufptr + ((hwaddr)(etsec->regs[TBDBPH].value & 0xF) << 32); - uint8_t padd[etsec->rx_padding]; + uint8_t padd[MAX_RX_PADDING]; uint8_t rem; + assert(etsec->rx_padding <= MAX_RX_PADDING); + RING_DEBUG("eTSEC fill Rx buffer @ 0x%016" HWADDR_PRIx " size:%zu(padding + crc:%u) + fcb:%u\n", bufptr, *size, etsec->rx_padding, etsec->rx_fcb_size); @@ -426,7 +434,7 @@ static void fill_rx_bd(eTSEC *etsec, rem = MIN(etsec->regs[MRBLR].value - bd->length, etsec->rx_padding); if (rem > 0) { - memset(padd, 0x0, sizeof(padd)); + memset(padd, 0x0, rem); etsec->rx_padding -= rem; *size -= rem; bd->length += rem;