qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH v5 29/33] nvdimm acpi: support Get Namespace Lab


From: Xiao Guangrong
Subject: Re: [Qemu-devel] [PATCH v5 29/33] nvdimm acpi: support Get Namespace Label Data function
Date: Thu, 29 Oct 2015 10:25:00 +0800
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0



On 10/29/2015 12:46 AM, Stefan Hajnoczi wrote:
On Wed, Oct 28, 2015 at 10:26:27PM +0000, Xiao Guangrong wrote:
+static void nvdimm_dsm_func_get_label_data(NVDIMMDevice *nvdimm,
+                                           nvdimm_dsm_in *in, GArray *out)
+{
+    NVDIMMClass *nvc = NVDIMM_GET_CLASS(nvdimm);
+    nvdimm_func_in_get_label_data *get_label_data = &in->func_get_label_data;
+    void *buf;
+    uint32_t status = NVDIMM_DSM_STATUS_SUCCESS;
+
+    le32_to_cpus(&get_label_data->offset);
+    le32_to_cpus(&get_label_data->length);
+
+    nvdimm_debug("Read Label Data: offset %#x length %#x.\n",
+                 get_label_data->offset, get_label_data->length);
+
+    if (nvdimm->label_size < get_label_data->offset + get_label_data->length) {

Integer overflow isn't handled here and it's unclear if that can cause
problems later on.  It's safest to catch it right away instead of
relying on nvc->read_label_data() to check again.


Good catch, Stefan! I will fix it by adding a additional check:

if (get_label_data->offset + get_label_data->length > get_label_data->offset) {
        nvdimm_debug("offset %#x + length %#x overflowed.\n");
        status = NVDIMM_DSM_DEV_STATUS_INVALID_PARAS;
        goto exit;
}




reply via email to

[Prev in Thread] Current Thread [Next in Thread]