From patchwork Fri Feb 26 14:41:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Norbert Manthey X-Patchwork-Id: 12106781 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AFC81C433DB for ; Fri, 26 Feb 2021 14:42:47 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 4DC6E64E28 for ; Fri, 26 Feb 2021 14:42:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4DC6E64E28 Authentication-Results: mail.kernel.org; dmarc=fail (p=quarantine dis=none) header.from=amazon.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from list by lists.xenproject.org with outflank-mailman.90355.171004 (Exim 4.92) (envelope-from ) id 1lFeKG-0003VA-Ep; Fri, 26 Feb 2021 14:42:40 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 90355.171004; Fri, 26 Feb 2021 14:42:40 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1lFeKG-0003Ux-Af; Fri, 26 Feb 2021 14:42:40 +0000 Received: by outflank-mailman (input) for mailman id 90355; Fri, 26 Feb 2021 14:42:39 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1lFeKF-0003Af-0i for xen-devel@lists.xenproject.org; Fri, 26 Feb 2021 14:42:39 +0000 Received: from smtp-fw-2101.amazon.com (unknown [72.21.196.25]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id f72aee7e-87fb-4250-a417-5e8e4e12b4e6; Fri, 26 Feb 2021 14:42:35 +0000 (UTC) Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-2c-579b7f5b.us-west-2.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-2101.iad2.amazon.com with ESMTP; 26 Feb 2021 14:42:35 +0000 Received: from EX13D02EUB003.ant.amazon.com (pdx1-ws-svc-p6-lb9-vlan3.pdx.amazon.com [10.236.137.198]) by email-inbound-relay-2c-579b7f5b.us-west-2.amazon.com (Postfix) with ESMTPS id 5220AA15CF; Fri, 26 Feb 2021 14:42:34 +0000 (UTC) Received: from EX13MTAUEB002.ant.amazon.com (10.43.60.12) by EX13D02EUB003.ant.amazon.com (10.43.166.172) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Fri, 26 Feb 2021 14:42:32 +0000 Received: from u6fc700a6f3c650.ant.amazon.com (10.1.212.27) by mail-relay.amazon.com (10.43.60.234) with Microsoft SMTP Server id 15.0.1497.2 via Frontend Transport; Fri, 26 Feb 2021 14:42:23 +0000 X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" X-Inumbo-ID: f72aee7e-87fb-4250-a417-5e8e4e12b4e6 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.de; i=@amazon.de; q=dns/txt; s=amazon201209; t=1614350555; x=1645886555; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=vbgIE8H3XZ85DmgU6vJvOMOFjDGWkhUCPA58yeFxSQY=; b=UP2scPgBu89tj4LtgnzPw/7OVOsUe84+39oH/hPuS7V5B6rEWmtIXNtl 7kGsVAfPKE6KPNdpqt9yIjzO+za0Zx6zvvDgZjIXiwDdbTZHCzDEVFU8D Mf39rjqw4HbxJo5FuJXhEBdmZSEoW9ii9kUgq8tBGNl+WCgKMC4uBkN2j U=; X-IronPort-AV: E=Sophos;i="5.81,208,1610409600"; d="scan'208";a="88504759" From: Norbert Manthey To: CC: Ian Jackson , Juergen Gross , Wei Liu , Julien Grall , Michael Kurth , Norbert Manthey Subject: [PATCH XENSTORE v1 06/10] xenstored: handle port reads correctly Date: Fri, 26 Feb 2021 15:41:40 +0100 Message-ID: <20210226144144.9252-7-nmanthey@amazon.de> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210226144144.9252-1-nmanthey@amazon.de> References: <20210226144144.9252-1-nmanthey@amazon.de> MIME-Version: 1.0 Precedence: Bulk The read value could be larger than a signed 32bit integer. As -1 is used as error value, we should not rely on using the full 32 bits. Hence, when reading the port number, we should make sure we only return valid values. This change sanity checks the input. The issue is that the value for the port is 1. transmitted as a string, with a fixed amount of digits. 2. Next, this string is parsed by a function that can deal with strings representing 64bit integers 3. A 64bit integer is returned, and will be truncated to it's lower 32bits, resulting in a wrong port number (in case the sender of the string decides to craft a suitable 64bit value). The value is typically provided by the kernel, which has this value hard coded in the proper range. As we use the function strtoul, non-digit character are considered as end of the input, and hence do not require checking. Therefore, this change only covers the corner case to make sure we stay in the 32 bit range. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Signed-off-by: Norbert Manthey Reviewed-by: Thomas Friebel Reviewed-by: Julien Grall --- tools/xenstore/xenstored_posix.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tools/xenstore/xenstored_posix.c b/tools/xenstore/xenstored_posix.c --- a/tools/xenstore/xenstored_posix.c +++ b/tools/xenstore/xenstored_posix.c @@ -116,7 +116,7 @@ evtchn_port_t xenbus_evtchn(void) { int fd; int rc; - evtchn_port_t port; + uint64_t port; char str[20]; fd = open(XENSTORED_PORT_DEV, O_RDONLY); @@ -136,6 +136,10 @@ evtchn_port_t xenbus_evtchn(void) port = strtoul(str, NULL, 0); close(fd); + + if (port >= UINT32_MAX) + return -1; + return port; }