[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 02/62] softmmu: Use memmove in flatview_write_continue
From: |
Richard Henderson |
Subject: |
[PULL 02/62] softmmu: Use memmove in flatview_write_continue |
Date: |
Tue, 28 Feb 2023 16:55:43 -1000 |
From: Akihiko Odaki <akihiko.odaki@daynix.com>
We found a case where the source passed to flatview_write_continue() may
overlap with the destination when fuzzing igb, a new proposed network
device with sanitizers.
igb uses pci_dma_map() to get Tx packet, and pci_dma_write() to write Rx
buffer. While pci_dma_write() is usually used to write data from
memory not mapped to the guest, if igb is configured to perform
loopback, the data will be sourced from the guest memory. The source and
destination can overlap and the usage of memcpy() will be invalid in
such a case.
While we do not really have to deal with such an invalid request for
igb, detecting the overlap in igb code beforehand requires complex code,
and only covers this specific case. Instead, just replace memcpy() with
memmove() to tolerate overlaps. Using memmove() will slightly damage the
performance as it will need to check overlaps before using SIMD
instructions for copying, but the cost should be negligible, considering
the inherent complexity of flatview_write_continue().
The test cases generated by the fuzzer is available at:
https://patchew.org/QEMU/20230129053316.1071513-1-alxndr@bu.edu/
The fixed test case is:
fuzz/crash_47dfe62d9f911bf523ff48cd441b61c0013ed805
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Acked-by: David Hildenbrand <david@redhat.com>
Message-Id: <20230131030155.18932-1-akihiko.odaki@daynix.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
softmmu/physmem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index df54b917a9..47143edb4f 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -2637,7 +2637,7 @@ static MemTxResult flatview_write_continue(FlatView *fv,
hwaddr addr,
} else {
/* RAM case */
ram_ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
- memcpy(ram_ptr, buf, l);
+ memmove(ram_ptr, buf, l);
invalidate_and_set_dirty(mr, addr1, l);
}
--
2.34.1
- [PULL 00/62] tcg patch queue, Richard Henderson, 2023/02/28
- [PULL 01/62] exec/helper-head: Include missing "fpu/softfloat-types.h" header, Richard Henderson, 2023/02/28
- [PULL 02/62] softmmu: Use memmove in flatview_write_continue,
Richard Henderson <=
- [PULL 03/62] accel/tcg: Add 'size' param to probe_access_flags(), Richard Henderson, 2023/02/28
- [PULL 04/62] accel/tcg: Add 'size' param to probe_access_full, Richard Henderson, 2023/02/28
- [PULL 05/62] include/exec: Introduce `CF_PCREL`, Richard Henderson, 2023/02/28
- [PULL 06/62] target/i386: set `CF_PCREL` in `x86_cpu_realizefn`, Richard Henderson, 2023/02/28
- [PULL 07/62] target/arm: set `CF_PCREL` in `arm_cpu_realizefn`, Richard Henderson, 2023/02/28
- [PULL 10/62] target/arm: Replace `TARGET_TB_PCREL` with `CF_PCREL`, Richard Henderson, 2023/02/28
- [PULL 08/62] accel/tcg: Replace `TARGET_TB_PCREL` with `CF_PCREL`, Richard Henderson, 2023/02/28
- [PULL 13/62] target/arm: Remove `TARGET_TB_PCREL` define, Richard Henderson, 2023/02/28
- [PULL 09/62] include/exec: Replace `TARGET_TB_PCREL` with `CF_PCREL`, Richard Henderson, 2023/02/28
- [PULL 14/62] target/i386: Remove `TARGET_TB_PCREL` define, Richard Henderson, 2023/02/28