{"id":1839946,"url":"http://patchwork.ozlabs.org/api/patches/1839946/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20230926201532.221152-3-vsementsov@yandex-team.ru/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":"","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20230926201532.221152-3-vsementsov@yandex-team.ru>","list_archive_url":null,"date":"2023-09-26T20:15:26","name":"[v2,2/8] util/filemonitor-inotify: qemu_file_monitor_watch(): assert no overflow","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"5a74c2a6d7fa705d686f02b078e820e03be9eac0","submitter":{"id":84116,"url":"http://patchwork.ozlabs.org/api/people/84116/?format=json","name":"Vladimir Sementsov-Ogievskiy","email":"vsementsov@yandex-team.ru"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20230926201532.221152-3-vsementsov@yandex-team.ru/mbox/","series":[{"id":375000,"url":"http://patchwork.ozlabs.org/api/series/375000/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=375000","date":"2023-09-26T20:15:27","name":"coverity fixes","version":2,"mbox":"http://patchwork.ozlabs.org/series/375000/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/1839946/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/1839946/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=yandex-team.ru header.i=@yandex-team.ru\n header.a=rsa-sha256 header.s=default header.b=y0gXSfiK;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)","mail-nwsmtp-smtp-corp-main-62.myt.yp-c.yandex.net;\n dkim=pass header.i=@yandex-team.ru"],"Received":["from lists.gnu.org (lists.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4Rw9zJ5zSDz1ypD\n\tfor ; Wed, 27 Sep 2023 06:18:04 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1qlETZ-0000Xn-OJ; Tue, 26 Sep 2023 16:16:09 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1qlETX-0000Wh-8l\n for qemu-devel@nongnu.org; Tue, 26 Sep 2023 16:16:07 -0400","from forwardcorp1b.mail.yandex.net\n ([2a02:6b8:c02:900:1:45:d181:df01])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1qlETR-0002h2-Pd\n for qemu-devel@nongnu.org; Tue, 26 Sep 2023 16:16:07 -0400","from mail-nwsmtp-smtp-corp-main-62.myt.yp-c.yandex.net\n (mail-nwsmtp-smtp-corp-main-62.myt.yp-c.yandex.net\n [IPv6:2a02:6b8:c12:550b:0:640:d49b:0])\n by forwardcorp1b.mail.yandex.net (Yandex) with ESMTP id 956E56079A;\n Tue, 26 Sep 2023 23:15:56 +0300 (MSK)","from vsementsov-lin.. (unknown [2a02:6b8:b081:b41d::1:39])\n by mail-nwsmtp-smtp-corp-main-62.myt.yp-c.yandex.net (smtpcorp/Yandex) with\n ESMTPSA id ZFWwvr0Oc0U0-DGo0cj3F; Tue, 26 Sep 2023 23:15:56 +0300"],"Precedence":"bulk","X-Yandex-Fwd":"1","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru;\n s=default; t=1695759356;\n bh=wvUasXlWa6y9/1/CgE5+CmyIWRY2KP5PRQL2MGutOgg=;\n h=Message-Id:Date:In-Reply-To:Cc:Subject:References:To:From;\n b=y0gXSfiKetMq0xgii1aqk35pMW9rV2weQ2Qo1vtYVyRLkmtK52Y163nClBW0EVKZ7\n IPTmRTqULjYyLHpeE0lNdE6KKrtp5POS3mBsqgrEfGCDgtuX97vy2jk/kB/EJV4p0N\n BBvEPYohzRbRInUTs4reo8ygIISDtj6XD7LStQg4=","From":"Vladimir Sementsov-Ogievskiy ","To":"qemu-devel@nongnu.org","Cc":"pbonzini@redhat.com, vsementsov@yandex-team.ru, peter.maydell@linaro.org,\n yc-core@yandex-team.ru, davydov-max@yandex-team.ru, =?utf-8?q?Daniel_P=2E_B?=\n\t=?utf-8?q?errang=C3=A9?= ","Subject":"[PATCH v2 2/8] util/filemonitor-inotify: qemu_file_monitor_watch():\n assert no overflow","Date":"Tue, 26 Sep 2023 23:15:26 +0300","Message-Id":"<20230926201532.221152-3-vsementsov@yandex-team.ru>","X-Mailer":"git-send-email 2.34.1","In-Reply-To":"<20230926201532.221152-1-vsementsov@yandex-team.ru>","References":"<20230926201532.221152-1-vsementsov@yandex-team.ru>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Received-SPF":"pass client-ip=2a02:6b8:c02:900:1:45:d181:df01;\n envelope-from=vsementsov@yandex-team.ru; helo=forwardcorp1b.mail.yandex.net","X-Spam_score_int":"-20","X-Spam_score":"-2.1","X-Spam_bar":"--","X-Spam_report":"(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,\n SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","List-Id":"","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"},"content":"Prefer clear assertions instead of [im]possible array overflow.\n\nSigned-off-by: Vladimir Sementsov-Ogievskiy \n---\n util/filemonitor-inotify.c | 25 +++++++++++++++++--------\n 1 file changed, 17 insertions(+), 8 deletions(-)","diff":"diff --git a/util/filemonitor-inotify.c b/util/filemonitor-inotify.c\nindex 2c45f7f176..2121111f38 100644\n--- a/util/filemonitor-inotify.c\n+++ b/util/filemonitor-inotify.c\n@@ -81,16 +81,25 @@ static void qemu_file_monitor_watch(void *arg)\n \n /* Loop over all events in the buffer */\n while (used < len) {\n- struct inotify_event *ev =\n- (struct inotify_event *)(buf + used);\n- const char *name = ev->len ? ev->name : \"\";\n- QFileMonitorDir *dir = g_hash_table_lookup(mon->idmap,\n- GINT_TO_POINTER(ev->wd));\n- uint32_t iev = ev->mask &\n- (IN_CREATE | IN_MODIFY | IN_DELETE | IN_IGNORED |\n- IN_MOVED_TO | IN_MOVED_FROM | IN_ATTRIB);\n+ const char *name;\n+ QFileMonitorDir *dir;\n+ uint32_t iev;\n int qev;\n gsize i;\n+ struct inotify_event *ev = (struct inotify_event *)(buf + used);\n+\n+ /*\n+ * We trust the kenel to provide valid buffer with complete event\n+ * records.\n+ */\n+ assert(len - used >= sizeof(struct inotify_event));\n+ assert(len - used - sizeof(struct inotify_event) >= ev->len);\n+\n+ name = ev->len ? ev->name : \"\";\n+ dir = g_hash_table_lookup(mon->idmap, GINT_TO_POINTER(ev->wd));\n+ iev = ev->mask &\n+ (IN_CREATE | IN_MODIFY | IN_DELETE | IN_IGNORED |\n+ IN_MOVED_TO | IN_MOVED_FROM | IN_ATTRIB);\n \n used += sizeof(struct inotify_event) + ev->len;\n \n","prefixes":["v2","2/8"]}