[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [xen master] xen: avoid UB in guest handle field accessors
commit 08daa72cdcb660c2f0aef52ee76a3704e2dd1b5b Author: Jan Beulich <jbeulich@xxxxxxxx> AuthorDate: Tue Jul 2 12:01:59 2024 +0200 Commit: Jan Beulich <jbeulich@xxxxxxxx> CommitDate: Tue Jul 2 12:01:59 2024 +0200 xen: avoid UB in guest handle field accessors Much like noted in 43d5c5d5f70b ("xen: avoid UB in guest handle arithmetic"), address calculations involved in accessing a struct field can overflow, too. Cast respective pointers to "unsigned long" and convert type checking accordingly. Remaining arithmetic is, despite there possibly being mathematical overflow, okay as per the C99 spec: "A computation involving unsigned operands can never overflow, because a result that cannot be represented by the resulting unsigned integer type is reduced modulo the number that is one greater than the largest value that can be represented by the resulting type." The overflow that we need to guard against is checked for in array_access_ok(). While there add the missing (see {,__}copy_to_guest_offset()) is-not- const checks to {,__}copy_field_to_guest(). Typically, but not always, no change to generated code; code generation (register allocation) is different for at least common/grant_table.c. Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> Acked-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx> Release-Acked-by: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx> --- xen/include/xen/guest_access.h | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/xen/include/xen/guest_access.h b/xen/include/xen/guest_access.h index 2e0971c487..6489924db6 100644 --- a/xen/include/xen/guest_access.h +++ b/xen/include/xen/guest_access.h @@ -95,16 +95,23 @@ /* Copy sub-field of a structure to guest context via a guest handle. */ #define copy_field_to_guest(hnd, ptr, field) ({ \ const typeof(&(ptr)->field) _s = &(ptr)->field; \ - void *_d = &(hnd).p->field; \ - (void)(&(hnd).p->field == _s); \ - raw_copy_to_guest(_d, _s, sizeof(*_s)); \ + unsigned long d_ = (unsigned long)(hnd).p; \ + /* Check that the handle is not for a const type */ \ + void *__maybe_unused _t = (hnd).p; \ + (void)((typeof_field(typeof(*(hnd).p), field) *)NULL == _s); \ + raw_copy_to_guest((void *)(d_ + offsetof(typeof(*(hnd).p), field)), \ + _s, sizeof(*_s)); \ }) /* Copy sub-field of a structure from guest context via a guest handle. */ #define copy_field_from_guest(ptr, hnd, field) ({ \ - const typeof(&(ptr)->field) _s = &(hnd).p->field; \ + unsigned long s_ = (unsigned long)(hnd).p; \ typeof(&(ptr)->field) _d = &(ptr)->field; \ - raw_copy_from_guest(_d, _s, sizeof(*_d)); \ + (void)((typeof_field(typeof(*(hnd).p), field) *)NULL == _d); \ + raw_copy_from_guest(_d, \ + (const void *)(s_ + \ + offsetof(typeof(*(hnd).p), field)), \ + sizeof(*_d)); \ }) #define copy_to_guest(hnd, ptr, nr) \ @@ -149,15 +156,22 @@ #define __copy_field_to_guest(hnd, ptr, field) ({ \ const typeof(&(ptr)->field) _s = &(ptr)->field; \ - void *_d = &(hnd).p->field; \ - (void)(&(hnd).p->field == _s); \ - __raw_copy_to_guest(_d, _s, sizeof(*_s)); \ + unsigned long d_ = (unsigned long)(hnd).p; \ + /* Check that the handle is not for a const type */ \ + void *__maybe_unused _t = (hnd).p; \ + (void)((typeof_field(typeof(*(hnd).p), field) *)NULL == _s); \ + __raw_copy_to_guest((void *)(d_ + offsetof(typeof(*(hnd).p), field)), \ + _s, sizeof(*_s)); \ }) #define __copy_field_from_guest(ptr, hnd, field) ({ \ - const typeof(&(ptr)->field) _s = &(hnd).p->field; \ + unsigned long s_ = (unsigned long)(hnd).p; \ typeof(&(ptr)->field) _d = &(ptr)->field; \ - __raw_copy_from_guest(_d, _s, sizeof(*_d)); \ + (void)((typeof_field(typeof(*(hnd).p), field) *)NULL == _d); \ + __raw_copy_from_guest(_d, \ + (const void *)(s_ + \ + offsetof(typeof(*(hnd).p), field)), \ + sizeof(*_d)); \ }) #define __copy_to_guest(hnd, ptr, nr) \ -- generated by git-patchbot for /home/xen/git/xen.git#master
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |