From patchwork Thu Aug 24 15:32:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 716550 Delivered-To: patch@linaro.org Received: by 2002:adf:f747:0:b0:317:ecd7:513f with SMTP id z7csp1409049wrp; Thu, 24 Aug 2023 08:34:30 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHeKZ/HjzZDSPj8tC35Ykzea3PWY3Gya5gD21kVH2PQ9FCkmAjMTQV4nkKILMeIQi4E31Fb X-Received: by 2002:a0c:b2c6:0:b0:64a:b025:6a6 with SMTP id d6-20020a0cb2c6000000b0064ab02506a6mr16086766qvf.18.1692891270367; Thu, 24 Aug 2023 08:34:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692891270; cv=none; d=google.com; s=arc-20160816; b=F+2FoMysX1c87XIQxNYF/dnaryWM93PcZ1ftxB824CHy9wfOrwBKarjhM+WzmRwA9T XDzbBFm+XOw9P4H2Ix80tfjl+AfHMR/50nayEN/nU2WPsM4cWTa65EXShyrGuYFDL3Ml U8Bet8EKmx0paYAEPjLRfbpJNp+s2ciuNd+dnCPtWsxd/bGWI47PvqLzsJ5W+q99x0Ei sHvWFaLadzinYERquov01riqVLpBFIxOXcQN5+CVE+IjFKTdD7YrfuuzW0UcXCh3LB3M YLs++1kewyTu4i9c88sh/q0TAgMZiA1BhnOTGpIOXt8mpRekrHC9a+PD+z5T689RHrbl UzaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=+p4+7OBfarchATd3tFruYfwM1HUum7CKIwxdMycnIKM=; fh=Z0x2Ey7gOsdpGu+VySi/dy0yVHR+oF2A4NjMARJ+yfE=; b=IKx0v8EnDXFzoP970DlPfzJeauO6puE34iwOBc50nA7ihu+XGHHuOQowTi4YsiEUmi 59f4DhlBaQeOW6PLrBMWnbB+Uk0GAxD1D5xUNPUsZS11BRKif7+OGLVKtTJV0PZq3LA3 gN0jWTUwclCnaCpOkmB8JmZpP55BgzOvAU7S88sHwL8i/ygzhu5l502bAzTTUHp34Zxa 0b7KizJ5Ox9L+jFZrrRPkpS3tz+RL5WI0mB6FfVFi8PFUUDyV2ybA6oQoI5qOQi29HU0 k7sEmXHLweNMr/wDaJ4CXzn9yG1h2BoPdqnmFruS1ahYczLY50cFoTFiVUG5B3q6ftLN IS4w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=rjEdiZuv; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id k6-20020a0cabc6000000b00649a1768b24si8390789qvb.466.2023.08.24.08.34.30 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 24 Aug 2023 08:34:30 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=rjEdiZuv; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qZCKH-0001TM-Ix; Thu, 24 Aug 2023 11:32:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qZCK0-0001Qd-PT for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: from mail-wr1-x432.google.com ([2a00:1450:4864:20::432]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qZCJw-0003RK-6i for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: by mail-wr1-x432.google.com with SMTP id ffacd0b85a97d-31c5327e5e8so682439f8f.1 for ; Thu, 24 Aug 2023 08:32:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+p4+7OBfarchATd3tFruYfwM1HUum7CKIwxdMycnIKM=; b=rjEdiZuvlGmaAlCSjOgehf8AnR+PPGiHqtfxMBDODCEBuGswKVHLOipVpPHxJ1wQte 8nvGZTRf3fBY/SNRthg3Ti2ktm0/dgqWA6rLHyAr+2txhydN2pVP7+Hit2i9SVVzb0PX g65Si9hmz8Amk6DgGynJHYx/lE6VsUuIQycW7z2F+gyR72uzHppZOkaD+EdwrVzrHzJt Jk9n5aI4iAvSqdR7XFdVWSEn+6Ijh/s9zVK/lvtyrkdK2qu/OCWskAervwodVofONOKk JUUR/iYW4PrPOcRMmTz97FRPxupRh7G/Z5k+Bo9reN0s6YdBQ+ntT+/Q7POu8WeHwl80 7sDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=+p4+7OBfarchATd3tFruYfwM1HUum7CKIwxdMycnIKM=; b=iaJSPwx/8R4DwEcFN3PkrmzzEHNChD6ZcHMVV605SERSgtiQRVS/LzrgBzhUY53bXd GM1cOtLBNqdCStDcKpapJNr9kMDkzgsE6zUmBxCRXJq7vBUsjHfVikfZ2n/HneRrU6/z 0xqnj3vf4+8+HPWSjuoGroi9gCoI/tsZbix85vGeW8Er7Mlum1DsG4OCRC94jpkKMh+B i7vPe9aH/clnRw6CjbRoA+24rKrj893Vp6pkAQPgasg58N9tQH8dfUktBHfoszgxyxDS fbiK7uS0sLGf0Rg1ABqozdyBQFWEk2VG4NUGnND7e7fzcDapdgU/7D/gaDsw/cRaMMKb fPiA== X-Gm-Message-State: AOJu0Yx5seNI6aiN7Pof1riv/HRWSK1Ta3Cdg1/6WssqdUxlnorITVJq nxFSnKkR/+Njq8r+RUSFfxJHGiAcOgdoTD3fkjs= X-Received: by 2002:a5d:688a:0:b0:317:e68f:e1af with SMTP id h10-20020a5d688a000000b00317e68fe1afmr12101385wru.20.1692891146209; Thu, 24 Aug 2023 08:32:26 -0700 (PDT) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by smtp.gmail.com with ESMTPSA id x4-20020adff0c4000000b003180fdf5589sm22918640wro.6.2023.08.24.08.32.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 08:32:25 -0700 (PDT) From: Peter Maydell To: qemu-devel@nongnu.org Cc: Jason Wang , Jiri Pirko , qemu-ppc@nongnu.org Subject: [PATCH 1/4] hw/net/fsl_etsec/rings.c: Avoid variable length array Date: Thu, 24 Aug 2023 16:32:21 +0100 Message-Id: <20230824153224.2517486-2-peter.maydell@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230824153224.2517486-1-peter.maydell@linaro.org> References: <20230824153224.2517486-1-peter.maydell@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::432; envelope-from=peter.maydell@linaro.org; helo=mail-wr1-x432.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org In fill_rx_bd() we create a variable length array of size etsec->rx_padding. In fact we know that this will never be larger than 64 bytes, because rx_padding is set in rx_init_frame() in a way that ensures it is only that large. Use a fixed sized array and assert that it is big enough. Since padd[] is now potentially rather larger than the actual padding required, adjust the memset() we do on it to match the size that we write with cpu_physical_memory_write(), rather than clearing the entire array. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé --- hw/net/fsl_etsec/rings.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/hw/net/fsl_etsec/rings.c b/hw/net/fsl_etsec/rings.c index 788463f1b62..2f2f359f7a5 100644 --- a/hw/net/fsl_etsec/rings.c +++ b/hw/net/fsl_etsec/rings.c @@ -372,6 +372,12 @@ void etsec_walk_tx_ring(eTSEC *etsec, int ring_nbr) etsec->regs[TSTAT].value |= 1 << (31 - ring_nbr); } +/* + * rx_init_frame() ensures we never do more padding than this + * (checksum plus minimum data packet size) + */ +#define MAX_RX_PADDING 64 + static void fill_rx_bd(eTSEC *etsec, eTSEC_rxtx_bd *bd, const uint8_t **buf, @@ -380,9 +386,11 @@ static void fill_rx_bd(eTSEC *etsec, uint16_t to_write; hwaddr bufptr = bd->bufptr + ((hwaddr)(etsec->regs[TBDBPH].value & 0xF) << 32); - uint8_t padd[etsec->rx_padding]; + uint8_t padd[MAX_RX_PADDING]; uint8_t rem; + assert(etsec->rx_padding <= MAX_RX_PADDING); + RING_DEBUG("eTSEC fill Rx buffer @ 0x%016" HWADDR_PRIx " size:%zu(padding + crc:%u) + fcb:%u\n", bufptr, *size, etsec->rx_padding, etsec->rx_fcb_size); @@ -426,7 +434,7 @@ static void fill_rx_bd(eTSEC *etsec, rem = MIN(etsec->regs[MRBLR].value - bd->length, etsec->rx_padding); if (rem > 0) { - memset(padd, 0x0, sizeof(padd)); + memset(padd, 0x0, rem); etsec->rx_padding -= rem; *size -= rem; bd->length += rem; From patchwork Thu Aug 24 15:32:22 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 716546 Delivered-To: patch@linaro.org Received: by 2002:adf:f747:0:b0:317:ecd7:513f with SMTP id z7csp1408373wrp; Thu, 24 Aug 2023 08:33:20 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHYFizBF3Uzbik8KdLR4gYv0rLPI+O6kJ9MU18jyklGGRTURhV7+g7dh+r1RfjuLGolQsLR X-Received: by 2002:a05:622a:210:b0:40f:ec76:1016 with SMTP id b16-20020a05622a021000b0040fec761016mr22484318qtx.50.1692891199972; Thu, 24 Aug 2023 08:33:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692891199; cv=none; d=google.com; s=arc-20160816; b=BPyjb8salPt7O7xG1L7e4ve2vOaqgctB/SLkVRmTQjmW+o4D5GBTv4Vjhv2lG1PWOv qgGEiU/S0DB0ZLCMX1nWAJtzf4euTHEDO2NSfiPUuhhL07ab7/AYq1Q6nuTcnz49o9+E jLx4Ilbvr6In8kyCQDx/K4R3MR9IL202pAII2gSeFAKetBEdAy3Qj5W509ql92xPtq2Q 2FQmafu6SDN6yfVmtr6Ft/KYkQ3XYW5EGalDXDPKLQj+LTRFb7bvD8ZWcNkXmNIgzDEo GENbm95FDyEbt8r/t6bxnpSo+ygwd1WLv1pwIH8V7TpTKjozpxFGgBCqMDRhxzE/30AM jimA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=N1qWg8feJuZrRJWeFrFVBID4g6bufzzYTzjbonZExcE=; fh=Z0x2Ey7gOsdpGu+VySi/dy0yVHR+oF2A4NjMARJ+yfE=; b=1Kw4v+Mrpt9tP4MnaSkSBnQHgt2rXx4UzdEGJzrVYT8EA3rxXIKbyWQYN0vmB92cMP 1ngewwe3NueFs9PoqKcJs4i6riO1GXPN5IV4d1dzc9UicKsvrXTg7jvzFbzONau/SqDk lcjDLJziQAr1KZubGYJhuejR1kBsm327+3xfZptJrRiP4xWYESBKbFRTR1b46DTVUF3s RIPF5hP7dDUhbqAT+7XwGX3nIkrLmIkLrqsgCPgWurPwf49sbHe0bVSRODx85cE2C3x1 caM78XMoV/iSeIBCv2jHf9q7e2WEj96XK/25ta74OtNC0jG1xm9n8Ec3vBrhFvjbiQK8 Ewkw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=nzLFcD71; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id e22-20020a05622a111600b00403f05ae952si8473802qty.578.2023.08.24.08.33.19 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 24 Aug 2023 08:33:19 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=nzLFcD71; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qZCK5-0001RK-NO; Thu, 24 Aug 2023 11:32:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qZCK0-0001QP-F9 for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: from mail-wr1-x433.google.com ([2a00:1450:4864:20::433]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qZCJw-0003RS-G6 for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: by mail-wr1-x433.google.com with SMTP id ffacd0b85a97d-31c5a2e8501so3584360f8f.0 for ; Thu, 24 Aug 2023 08:32:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=N1qWg8feJuZrRJWeFrFVBID4g6bufzzYTzjbonZExcE=; b=nzLFcD71715APsNfj4FDqp0XQORAQxZRmM4ruAmVHK3M+p2dx+pkXGCkExSL9ZkNoM 8bBZ/21U19yIunr5KQC7RQbqx/v5srt0lhvhkaPIiO8ga/szHvjT2Ram5mY8QZEWqaCK AmplR7PrpE7fTJeWLszBgsPxwCO268okt8PS69aGLk4MmXyAhnVauCtDLzgFy02E3AGo DWc/paU2ry7sU5M2b9N0pwbgRJCwkNHja6cTrpRDrPdkmM6H6cJTyALWJhp4Ixyoqy4T 7vSDJsiOmXjAwrqJ6v1AFc6S2eFruSUopnDTahJzxIECNf47J7MdqIG2kkmR0lSPziyO kzmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692891146; x=1693495946; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=N1qWg8feJuZrRJWeFrFVBID4g6bufzzYTzjbonZExcE=; b=kKBSoUwrznUFJs3P7YXbatThF4OEor+gOxuYMwqHJU3wTPpYhZlvxqmU4tw+AtcXE6 RbvQbScGuHDLCeZn5kHFYjocxqCGhoJFFdG0dtwj73dPfE/MrUoP9yJF5rq69Uqyk7ZE lo5qHcvq/JKddUHAyUUWXmRqigX/eETRTL1o/maaxW3y70zQ/b2djsjdEgoKHYJ+P9Lh XiEiuQe/0nPbgRMhVm2AlMPkwqo2N/svLHyydUd9ceGU66i/pdCoguTxOryFlXw7257x i4ypa5Yq2rBwyQI4DfF5g0Qf5fKScmab1FHgx4ZGztnHJs8xwFXXR3lkI3jJ0/DMJHpK fQNg== X-Gm-Message-State: AOJu0YzuzzI1632B3rHsu/qUjmhEm7NzuGW+ZG9FdLrMG9/FUswxldLV t08TjVyb0/ut0QN10gbN7Npa3j082k8wUClOmTk= X-Received: by 2002:a5d:574d:0:b0:319:6ec3:79c7 with SMTP id q13-20020a5d574d000000b003196ec379c7mr11862725wrw.36.1692891146821; Thu, 24 Aug 2023 08:32:26 -0700 (PDT) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by smtp.gmail.com with ESMTPSA id x4-20020adff0c4000000b003180fdf5589sm22918640wro.6.2023.08.24.08.32.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 08:32:26 -0700 (PDT) From: Peter Maydell To: qemu-devel@nongnu.org Cc: Jason Wang , Jiri Pirko , qemu-ppc@nongnu.org Subject: [PATCH 2/4] hw/net/rocker: Avoid variable length array Date: Thu, 24 Aug 2023 16:32:22 +0100 Message-Id: <20230824153224.2517486-3-peter.maydell@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230824153224.2517486-1-peter.maydell@linaro.org> References: <20230824153224.2517486-1-peter.maydell@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::433; envelope-from=peter.maydell@linaro.org; helo=mail-wr1-x433.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Replace an on-stack variable length array in of_dpa_ig() with a g_autofree heap allocation. The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Francisco Iglesias --- hw/net/rocker/rocker_of_dpa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c index dfe47544694..5e16056be66 100644 --- a/hw/net/rocker/rocker_of_dpa.c +++ b/hw/net/rocker/rocker_of_dpa.c @@ -1043,7 +1043,7 @@ static void of_dpa_flow_ig_tbl(OfDpaFlowContext *fc, uint32_t tbl_id) static ssize_t of_dpa_ig(World *world, uint32_t pport, const struct iovec *iov, int iovcnt) { - struct iovec iov_copy[iovcnt + 2]; + g_autofree struct iovec *iov_copy = g_new(struct iovec, iovcnt + 2); OfDpaFlowContext fc = { .of_dpa = world_private(world), .in_pport = pport, From patchwork Thu Aug 24 15:32:23 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 716549 Delivered-To: patch@linaro.org Received: by 2002:adf:f747:0:b0:317:ecd7:513f with SMTP id z7csp1408825wrp; Thu, 24 Aug 2023 08:34:05 -0700 (PDT) X-Google-Smtp-Source: AGHT+IH08oVd4SByqrW7NtFaZJYIYT79SvJTHabWRfDc4GtE1EoWSLHC+mQMDj24ALwQd0jXWSqW X-Received: by 2002:a05:620a:1232:b0:767:b4c0:45a1 with SMTP id v18-20020a05620a123200b00767b4c045a1mr14406043qkj.66.1692891245152; Thu, 24 Aug 2023 08:34:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692891245; cv=none; d=google.com; s=arc-20160816; b=uxc2h9vk96hLntypYFUPf2IY6WD3Ilth4sJtQNoseHcyAZ6/8pEOwOzt5wSCxiGLC1 P62MS0etlVouusHVzfGMHD2pQVbnpMiyAOKt9ni9qS29uyUIsEkrAx2st3z1IiBA0aHc I6LPMZRXuryu9C8N1OD57nKlNBt4qgcjXad7nwG4JOLLKqcB20IE870qRnuLmh0BIYas pbNscbBajq+wdFf7qwXYqnmiNh89YPVLgmpLdwM6xc+pVQPixH8PlGaPo9A04EVbb+cx xdh8aV5I751aATXHclSUpzJ8F5vECMK7fQ8dA7pXSP6j+I8BgJ1a8+Y395RvIuUz2clD CLQA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=1qYdyuRUyB59fnCJVcILwIEL2Oej6/htVufBepr+AMU=; fh=Z0x2Ey7gOsdpGu+VySi/dy0yVHR+oF2A4NjMARJ+yfE=; b=W7Oxu7ZCeQMiHrSGuKX/P1i2Su9DmOLE6In5BVLd3ybIIX759JdJAI1kdtZ5YbUQPh 0Gj4QKFZX57ZJwYL9uZ5IuWg0OT1xFmH8ZnMRCDVg+VlmiTvr8jjC3CR6OX49w33N71l x6An1LUkx8casE1QwyXkMO8wrV/MWIQsQh9LWc8mni0sIR85XpFHQegopwuYzXhfqHZ1 u3+ob4fAI7BGXFdQy/gZELr7v5smB+fnWOwMVtNefyf5YvIhydy6CmhYo3kE4kZXbhqj lf1Fkvi9ba/N5J5uKxcBRjwV+hfLIXdDK40DN7O6Z+icKBIL9OSyKLhfsMqm4KnUzXiW 8yzA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="qc4NdCC/"; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id sw8-20020a05620a4bc800b0076ccd9d5ec3si1142864qkn.391.2023.08.24.08.34.04 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 24 Aug 2023 08:34:05 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b="qc4NdCC/"; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qZCK5-0001RO-O6; Thu, 24 Aug 2023 11:32:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qZCK0-0001Qc-OK for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: from mail-wr1-x431.google.com ([2a00:1450:4864:20::431]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qZCJw-0003RZ-QN for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:32 -0400 Received: by mail-wr1-x431.google.com with SMTP id ffacd0b85a97d-313e742a787so8649f8f.1 for ; Thu, 24 Aug 2023 08:32:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1692891147; x=1693495947; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=1qYdyuRUyB59fnCJVcILwIEL2Oej6/htVufBepr+AMU=; b=qc4NdCC/sBDHPYgc43jZCxJzBrao70Jwgren4yBhVL6TPt3JGppRsWWCga2cmIHmez U1SjhYcOyiSGl7bQmiYankLQWr9gaf2WRHXwxaGb5ct4PAhohr9uobA0Ut9mImH28ORw 9RkMhozzpbfPCUKtXti1MggehiWhW7m0tKoIr6vo/im1fAiBgRL2yAMEyMcTeGv/3xlq zsNGrYXfZtEk0uwAg/hn0l1DiYSb0L9i2ibbz4yDcZhq6NihJ+lYBF7hP07VwRip4UUe pq8Seh9XW+jiqVDX6TER7im8JB6oWJSM8bpchuJNYTJ2644er6bbTf0IFpLGOEkf8iOQ i+vg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692891147; x=1693495947; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=1qYdyuRUyB59fnCJVcILwIEL2Oej6/htVufBepr+AMU=; b=QlOIE3QctCvuSE/kbIcpjUeq8x0RQd1JCgaEY4+z9GKj9rat8T/8fA+pq3ObslYSBp HV+tET3EAqyrJh49JihjF/aLj8NYoq7F9DOzdYON8GRw3WPq5Uk/1uD7/bRJZ2nOmOL9 fQysmF2u+5+KcbTzNUI8v6Fa7T/AbxG0B2GCd9dvWzMySIonRSlf24H5R7FSkPv3cyjM iYnLv4dGE8WzS597ysrJoxLWDWFJAyclyRKm86CO24Y2yu+uFowYnGiXMUN48PfzFBR2 FxSI5m7y4C2Waj0fm/kSGkiSmcgedrf2HrWTqWO8Mpgnw/8APMRVlELkj/1MVrwG4kEz vehQ== X-Gm-Message-State: AOJu0YxRRjcrBTcuk4/uz1cpgM714IjadSeW3swqeKwUnT3Fm7d07Lla RDohkwgB0LOYCrv8cc80Esl1n8xL73ERo3T/9y4= X-Received: by 2002:adf:e849:0:b0:317:a499:72c8 with SMTP id d9-20020adfe849000000b00317a49972c8mr10562895wrn.1.1692891147305; Thu, 24 Aug 2023 08:32:27 -0700 (PDT) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by smtp.gmail.com with ESMTPSA id x4-20020adff0c4000000b003180fdf5589sm22918640wro.6.2023.08.24.08.32.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 08:32:27 -0700 (PDT) From: Peter Maydell To: qemu-devel@nongnu.org Cc: Jason Wang , Jiri Pirko , qemu-ppc@nongnu.org Subject: [PATCH 3/4] net/dump: Avoid variable length array Date: Thu, 24 Aug 2023 16:32:23 +0100 Message-Id: <20230824153224.2517486-4-peter.maydell@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230824153224.2517486-1-peter.maydell@linaro.org> References: <20230824153224.2517486-1-peter.maydell@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::431; envelope-from=peter.maydell@linaro.org; helo=mail-wr1-x431.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Use a g_autofree heap allocation instead of a variable length array in dump_receive_iov(). The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Francisco Iglesias --- net/dump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/dump.c b/net/dump.c index 7d05f16ca7a..16073f24582 100644 --- a/net/dump.c +++ b/net/dump.c @@ -68,7 +68,7 @@ static ssize_t dump_receive_iov(DumpState *s, const struct iovec *iov, int cnt, int64_t ts; int caplen; size_t size = iov_size(iov, cnt) - offset; - struct iovec dumpiov[cnt + 1]; + g_autofree struct iovec *dumpiov = g_new(struct iovec, cnt + 1); /* Early return in case of previous error. */ if (s->fd < 0) { From patchwork Thu Aug 24 15:32:24 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 716548 Delivered-To: patch@linaro.org Received: by 2002:adf:f747:0:b0:317:ecd7:513f with SMTP id z7csp1408476wrp; Thu, 24 Aug 2023 08:33:28 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGZrYCrEv5v30qEyrkH5/qE0rBwrjqj4ImN2INVQ8PfYDTe+pmm95R0DHMpnnWEzkk5IigO X-Received: by 2002:a1f:4f82:0:b0:48d:e62:68cf with SMTP id d124-20020a1f4f82000000b0048d0e6268cfmr10944806vkb.14.1692891208391; Thu, 24 Aug 2023 08:33:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692891208; cv=none; d=google.com; s=arc-20160816; b=C7aLBcdUpYe3f/glxJfwo9A90DjF3FjHmN8DbB5LLHM4WEmzXs48CE0hv5dj79DaBE M0heyPPyjkumQhbm72y8XCnjNntJMBgeFD+N+jAeZ0cuk5nIPlUZfcRo1RRDKD0CgTaw IT+cD17X8lL1yUyDQLqOcMk8cRRphl1CJHp+qbK0lJPOL6Y1ikVwlXl+BLXcSRU/kgbm YyWRNturjXMPi26/urvanLRM/6YujGSYtyckx6BnVc28mxcB7JbBOeRczqh+A5m1yRVM zLNbs6+Og5Kbsjy5phxGeaNzgxv4aFiDSvG9ZzOOhpbgMjv+7pbODnbbEBLADpEc/D9E x2HQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=2MJwmp/YT87omTafaKV+iKF01Q0/GZOVi91ih3V6Y9c=; fh=Z0x2Ey7gOsdpGu+VySi/dy0yVHR+oF2A4NjMARJ+yfE=; b=SApFzEwJu8tdkucGHaQIlgW+sBFfInxreZ3K+ayzfTpHeN8WpK+ksrSQx+XjUJuZRb LKchw3vN5r94MNUfJxKoK7RjhqRsJQ+LdOSWS6WvJBUbHdcS9GyQBONnlFnqesgXazV5 9EH3gGgnT9kZuD+RUGU0tgUnagd7mDmTdo1vhQD8uY6FUqyKVD8S28WAn9FB8Jv6yqTf /GW4nbP05EC/1kCRVOH9ObbGWfa6Eg0mQR1lSi8grZpePd1lGmNTIMZouwba2sFDu+/X YQ+/zQC5Rv1IleZla5bhH6wt6MJ23BcdRv0UiyOYpfVv9u3SWAfdKOVOQp9iK4JPEG6e NOlA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=snhFSuRq; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id b9-20020ac85bc9000000b0040399b08543si1121281qtb.275.2023.08.24.08.33.28 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 24 Aug 2023 08:33:28 -0700 (PDT) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=snhFSuRq; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qZCKL-0001dy-N7; Thu, 24 Aug 2023 11:32:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qZCK2-0001RJ-B5 for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:36 -0400 Received: from mail-wm1-x32e.google.com ([2a00:1450:4864:20::32e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qZCJx-0003Rk-FL for qemu-devel@nongnu.org; Thu, 24 Aug 2023 11:32:34 -0400 Received: by mail-wm1-x32e.google.com with SMTP id 5b1f17b1804b1-3fef56f7223so33549555e9.3 for ; Thu, 24 Aug 2023 08:32:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1692891148; x=1693495948; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=2MJwmp/YT87omTafaKV+iKF01Q0/GZOVi91ih3V6Y9c=; b=snhFSuRqMgrk+13ZJHN5POLH8fH1pGmd60/+cLqKATpWWi37mSxz1N9rRa4cIEhCdm GFKth4UkfYUz1ELvzCwGR7J8nqNcNOPa0OpqRiKceERQb7suwZIdA/+rcg8htk2Xnj6+ aqwMY66U1ItNfjxkJu5208iKIMKUk0tpliaOi8fH31lCSJVnCM8E8Y2rj/ROkUUAi01R Hu1MK3bcpF/A4zheNUOnYhSKPJkEYsPQM/1wDkDvoitip8H/3UR9mhbs+21Wqt+V51hT R/v7na6hE3DOvfnCr1RH1PMlxhFlXwPMUy4H5YPdAawxUCtu6XrRJPc/31fRBlfE+ZVT jCGw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692891148; x=1693495948; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=2MJwmp/YT87omTafaKV+iKF01Q0/GZOVi91ih3V6Y9c=; b=gUYr61zI9BK7e32cI+GjIGssSB9C77VYihLMc/KoSKN+krEswtqG7+RZ7F09k5FpPt x5g+C+ZIco7BQe5f7tSMebu4oKzVrsQBk3KM0mpijgRpJ1095v6xmQkH1aLozQqkjzBd 7EXy+Xfn/VnXysg7JnoqRBBV7T89lyZXmUwhg+1SIgFua9p0/H2tTcMVzcZyxB/MpTlG jhnjyNodvd4JW9eRpLn1clVVbrYmw+Q5LOm1/v1/Eq7fLsNfnI5Zi53Q6xaYJ8urjf7V BGxp1f+5nBonqM71pJxrAztJg6zhVecllFm6+zfo7aDfQImrMa8ehFc8oGh39AZlN0rW /fbg== X-Gm-Message-State: AOJu0YwVxdaXzUGQ7EEEB82u/9jI4eEv4sTxBN9XX88Bdc3Sr6IyDgUd aH/MqKs2tvSxt0xpNPaDUqlivZrMww9AvN/G8ZA= X-Received: by 2002:adf:e645:0:b0:31a:d90e:42cd with SMTP id b5-20020adfe645000000b0031ad90e42cdmr12474790wrn.35.1692891147894; Thu, 24 Aug 2023 08:32:27 -0700 (PDT) Received: from orth.archaic.org.uk (orth.archaic.org.uk. [2001:8b0:1d0::2]) by smtp.gmail.com with ESMTPSA id x4-20020adff0c4000000b003180fdf5589sm22918640wro.6.2023.08.24.08.32.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Aug 2023 08:32:27 -0700 (PDT) From: Peter Maydell To: qemu-devel@nongnu.org Cc: Jason Wang , Jiri Pirko , qemu-ppc@nongnu.org Subject: [PATCH 4/4] net/tap: Avoid variable-length array Date: Thu, 24 Aug 2023 16:32:24 +0100 Message-Id: <20230824153224.2517486-5-peter.maydell@linaro.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230824153224.2517486-1-peter.maydell@linaro.org> References: <20230824153224.2517486-1-peter.maydell@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::32e; envelope-from=peter.maydell@linaro.org; helo=mail-wm1-x32e.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org Use a heap allocation instead of a variable length array in tap_receive_iov(). The codebase has very few VLAs, and if we can get rid of them all we can make the compiler error on new additions. This is a defensive measure against security bugs where an on-stack dynamic allocation isn't correctly size-checked (e.g. CVE-2021-3527). Signed-off-by: Peter Maydell Reviewed-by: Francisco Iglesias --- net/tap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/tap.c b/net/tap.c index 1bf085d4228..34b1e3f0918 100644 --- a/net/tap.c +++ b/net/tap.c @@ -117,10 +117,11 @@ static ssize_t tap_receive_iov(NetClientState *nc, const struct iovec *iov, { TAPState *s = DO_UPCAST(TAPState, nc, nc); const struct iovec *iovp = iov; - struct iovec iov_copy[iovcnt + 1]; + g_autofree struct iovec *iov_copy = NULL; struct virtio_net_hdr_mrg_rxbuf hdr = { }; if (s->host_vnet_hdr_len && !s->using_vnet_hdr) { + iov_copy = g_new(struct iovec, iovcnt + 1); iov_copy[0].iov_base = &hdr; iov_copy[0].iov_len = s->host_vnet_hdr_len; memcpy(&iov_copy[1], iov, iovcnt * sizeof(*iov));