mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

linux-user: Use signed lengths in uaccess.c

Browse Source 
Partially revert 09f679b62d, but only for the length arguments.
Instead of reverting to long, use ssize_t.  Reinstate the > 0 check
in unlock_user.

Fixes: 09f679b62d
Reported-by: Coverity (CID 1446711)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20210315204004.2025219-1-richard.henderson@linaro.org>
[lv: remove superfluous semicolon]
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
This commit is contained in:
Richard Henderson 2021-03-15 14:40:04 -06:00 committed by Laurent Vivier
parent d0d3dd401b
commit 360f0abdc5
2 changed files with 15 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
linux-user/qemu.h
View File

@ -627,8 +627,8 @@ static inline bool access_ok(CPUState *cpu, int type,
* buffers between the target and host. These internally perform * buffers between the target and host. These internally perform
* locking/unlocking of the memory. * locking/unlocking of the memory.
*/ */
int copy_from_user(void *hptr, abi_ulong gaddr, size_t len); int copy_from_user(void *hptr, abi_ulong gaddr, ssize_t len);
int copy_to_user(abi_ulong gaddr, void *hptr, size_t len); int copy_to_user(abi_ulong gaddr, void *hptr, ssize_t len);
/* Functions for accessing guest memory. The tget and tput functions /* Functions for accessing guest memory. The tget and tput functions
read/write single values, byteswapping as necessary. The lock_user function read/write single values, byteswapping as necessary. The lock_user function
@ -638,16 +638,19 @@ int copy_to_user(abi_ulong gaddr, void *hptr, size_t len);
/* Lock an area of guest memory into the host. If copy is true then the /* Lock an area of guest memory into the host. If copy is true then the
host area will have the same contents as the guest. */ host area will have the same contents as the guest. */
void *lock_user(int type, abi_ulong guest_addr, size_t len, bool copy); void *lock_user(int type, abi_ulong guest_addr, ssize_t len, bool copy);
/* Unlock an area of guest memory. The first LEN bytes must be /* Unlock an area of guest memory. The first LEN bytes must be
flushed back to guest memory. host_ptr = NULL is explicitly flushed back to guest memory. host_ptr = NULL is explicitly
allowed and does nothing. */ allowed and does nothing. */
#ifndef DEBUG_REMAP #ifndef DEBUG_REMAP
static inline void unlock_user(void *host_ptr, abi_ulong guest_addr, size_t len) static inline void unlock_user(void *host_ptr, abi_ulong guest_addr,
{ } ssize_t len)
{
/* no-op */
}
#else #else
void unlock_user(void *host_ptr, abi_ulong guest_addr, long len); void unlock_user(void *host_ptr, abi_ulong guest_addr, ssize_t len);
#endif #endif
/* Return the length of a string in target memory or -TARGET_EFAULT if /* Return the length of a string in target memory or -TARGET_EFAULT if

12
linux-user/uaccess.c
View File

@ -4,7 +4,7 @@
#include "qemu.h" #include "qemu.h"
void *lock_user(int type, abi_ulong guest_addr, size_t len, bool copy) void *lock_user(int type, abi_ulong guest_addr, ssize_t len, bool copy)
{ {
void *host_addr; void *host_addr;
@ -24,7 +24,7 @@ void *lock_user(int type, abi_ulong guest_addr, size_t len, bool copy)
} }
#ifdef DEBUG_REMAP #ifdef DEBUG_REMAP
void unlock_user(void *host_ptr, abi_ulong guest_addr, size_t len); void unlock_user(void *host_ptr, abi_ulong guest_addr, ssize_t len)
{ {
void *host_ptr_conv; void *host_ptr_conv;
@ -35,7 +35,7 @@ void unlock_user(void *host_ptr, abi_ulong guest_addr, size_t len);
if (host_ptr == host_ptr_conv) { if (host_ptr == host_ptr_conv) {
return; return;
} }
if (len != 0) { if (len > 0) {
memcpy(host_ptr_conv, host_ptr, len); memcpy(host_ptr_conv, host_ptr, len);
} }
g_free(host_ptr); g_free(host_ptr);
@ -48,14 +48,14 @@ void *lock_user_string(abi_ulong guest_addr)
if (len < 0) { if (len < 0) {
return NULL; return NULL;
} }
return lock_user(VERIFY_READ, guest_addr, (size_t)len + 1, 1); return lock_user(VERIFY_READ, guest_addr, len + 1, 1);
} }
/* copy_from_user() and copy_to_user() are usually used to copy data /* copy_from_user() and copy_to_user() are usually used to copy data
* buffers between the target and host. These internally perform * buffers between the target and host. These internally perform
* locking/unlocking of the memory. * locking/unlocking of the memory.
*/ */
int copy_from_user(void *hptr, abi_ulong gaddr, size_t len) int copy_from_user(void *hptr, abi_ulong gaddr, ssize_t len)
{ {
int ret = 0; int ret = 0;
void *ghptr = lock_user(VERIFY_READ, gaddr, len, 1); void *ghptr = lock_user(VERIFY_READ, gaddr, len, 1);
@ -69,7 +69,7 @@ int copy_from_user(void *hptr, abi_ulong gaddr, size_t len)
return ret; return ret;
} }
int copy_to_user(abi_ulong gaddr, void *hptr, size_t len) int copy_to_user(abi_ulong gaddr, void *hptr, ssize_t len)
{ {
int ret = 0; int ret = 0;
void *ghptr = lock_user(VERIFY_WRITE, gaddr, len, 0); void *ghptr = lock_user(VERIFY_WRITE, gaddr, len, 0);