From patchwork Tue Jun 1 15:57:54 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Stefan Hajnoczi X-Patchwork-Id: 12291687 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MIME_BASE64_TEXT,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71B9BC4708F for ; Tue, 1 Jun 2021 15:59:17 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id C8706613AD for ; Tue, 1 Jun 2021 15:59:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C8706613AD Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:49412 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lo6nT-0000HO-Oe for qemu-devel@archiver.kernel.org; Tue, 01 Jun 2021 11:59:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:58846) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lo6mY-00070Z-H2 for qemu-devel@nongnu.org; Tue, 01 Jun 2021 11:58:18 -0400 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:50189) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lo6mV-0007vW-7x for qemu-devel@nongnu.org; Tue, 01 Jun 2021 11:58:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1622563094; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ln7dKDIdS2Ok07dRe0TxA9iBDNDE9dyXN/6L3bb8Xec=; b=dQ0BP2Zp4tz/FYfyYUb165oafGq71iDWyHwr9JegfxcNYIebpC7XQNwtB14CbckHkxF9dR 1tnZkDkBu96yFERFgOcjh4N3zPRKLlYNnZE/CNpn3Q5qrn+IXHKnnuTIiNtpnkkHtu5Nxx KT1Z3rZdtXKXfHdvfC6+lj4AYHrqUdI= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-269-3YyEhxl6OOyhFaEevcNU4Q-1; Tue, 01 Jun 2021 11:58:12 -0400 X-MC-Unique: 3YyEhxl6OOyhFaEevcNU4Q-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id ECDEF81840B; Tue, 1 Jun 2021 15:58:10 +0000 (UTC) Received: from localhost (ovpn-113-244.ams2.redhat.com [10.36.113.244]) by smtp.corp.redhat.com (Postfix) with ESMTP id 60D2219C44; Tue, 1 Jun 2021 15:58:04 +0000 (UTC) From: Stefan Hajnoczi To: qemu-devel@nongnu.org Subject: [PATCH v2 1/2] vhost-user-blk-test: fix Coverity open(2) false positives Date: Tue, 1 Jun 2021 16:57:54 +0100 Message-Id: <20210601155755.216949-2-stefanha@redhat.com> In-Reply-To: <20210601155755.216949-1-stefanha@redhat.com> References: <20210601155755.216949-1-stefanha@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=stefanha@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Received-SPF: pass client-ip=216.205.24.124; envelope-from=stefanha@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -13 X-Spam_score: -1.4 X-Spam_bar: - X-Spam_report: (-1.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.371, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MIME_BASE64_TEXT=1.741, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Laurent Vivier , Kevin Wolf , Thomas Huth , qemu-block@nongnu.org, Peter Maydell , Coiby Xu , Gerd Hoffmann , Stefan Hajnoczi , Paolo Bonzini Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" Coverity checks that the file descriptor return value of open(2) is checked and used. Normally this is helpful in identifying real bugs but vhost-user-blk-test opens /dev/null as stdin and stdout after fork. In this case we don't need to look at the return value because these open(2) calls cannot fail in any reasonable environment. We already know their return values ahead of time since we closed stdin and stdout previously. open(2) is guaranteed to pick the lowest available fd number. Silence Coverity by introducing code that checks what we already know to be true. ** CID 1453270: Resource leaks (RESOURCE_LEAK) /qemu/tests/qtest/vhost-user-blk-test.c: 920 in start_vhost_user_blk() Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth diff --git a/tests/qtest/vhost-user-blk-test.c b/tests/qtest/vhost-user-blk-test.c index 8796c74ca4..c5c4667759 100644 --- a/tests/qtest/vhost-user-blk-test.c +++ b/tests/qtest/vhost-user-blk-test.c @@ -910,14 +910,18 @@ static void start_vhost_user_blk(GString *cmd_line, int vus_instances, storage_daemon_command->str); pid_t pid = fork(); if (pid == 0) { + int fd; + /* * Close standard file descriptors so tap-driver.pl pipe detects when * our parent terminates. */ close(0); + fd = open("/dev/null", O_RDONLY); + g_assert_cmpint(fd, ==, 0); close(1); - open("/dev/null", O_RDONLY); - open("/dev/null", O_WRONLY); + fd = open("/dev/null", O_WRONLY); + g_assert_cmpint(fd, ==, 1); execlp("/bin/sh", "sh", "-c", storage_daemon_command->str, NULL); exit(1); From patchwork Tue Jun 1 15:57:55 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Stefan Hajnoczi X-Patchwork-Id: 12291709 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.8 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,MIME_BASE64_TEXT,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF90CC47093 for ; Tue, 1 Jun 2021 16:11:49 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 61F6760FD8 for ; Tue, 1 Jun 2021 16:11:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 61F6760FD8 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:56444 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lo6qf-0005TQ-UZ for qemu-devel@archiver.kernel.org; Tue, 01 Jun 2021 12:02:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:58926) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lo6me-0007EV-Cv for qemu-devel@nongnu.org; Tue, 01 Jun 2021 11:58:24 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]:45897) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lo6mc-00080t-LQ for qemu-devel@nongnu.org; Tue, 01 Jun 2021 11:58:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1622563101; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bXTaWhOPtcGoxS4emjtrp1bVKeiRhwHglzBAWuwMz20=; b=ArL9weQHyfNXJD6EV3kkPkTHyaynH2hFFrZ2bxfaId2CRkFwcBxnga6IsJkOcsDD3npkWE 2k8v/0epMXh9oxviODit08i4Ta0y286K3GhWljmJhMa4scsoO1sRnxeO3sSAyrsasNgQ/5 yVCLZaZb0qh+coysllcjnobwTRkByCM= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-286-37jo1wkaNDe5fNgLsD62Pg-1; Tue, 01 Jun 2021 11:58:20 -0400 X-MC-Unique: 37jo1wkaNDe5fNgLsD62Pg-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 5EB65106BB2D; Tue, 1 Jun 2021 15:58:19 +0000 (UTC) Received: from localhost (ovpn-113-244.ams2.redhat.com [10.36.113.244]) by smtp.corp.redhat.com (Postfix) with ESMTP id 372755D6CF; Tue, 1 Jun 2021 15:58:12 +0000 (UTC) From: Stefan Hajnoczi To: qemu-devel@nongnu.org Subject: [PATCH v2 2/2] ui/vdagent: fix clipboard info memory leak in error path Date: Tue, 1 Jun 2021 16:57:55 +0100 Message-Id: <20210601155755.216949-3-stefanha@redhat.com> In-Reply-To: <20210601155755.216949-1-stefanha@redhat.com> References: <20210601155755.216949-1-stefanha@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=stefanha@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Received-SPF: pass client-ip=170.10.133.124; envelope-from=stefanha@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -13 X-Spam_score: -1.4 X-Spam_bar: - X-Spam_report: (-1.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.371, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MIME_BASE64_TEXT=1.741, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Laurent Vivier , Kevin Wolf , Thomas Huth , qemu-block@nongnu.org, Peter Maydell , Coiby Xu , Gerd Hoffmann , Stefan Hajnoczi , Paolo Bonzini Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" If the size of a VD_AGENT_CLIPBOARD_GRAB message is invalid we leak info when returning early. Thanks to Coverity for spotting this: *** CID 1453266: Resource leaks (RESOURCE_LEAK) /qemu/ui/vdagent.c: 465 in vdagent_chr_recv_clipboard() 459 info = qemu_clipboard_info_new(&vd->cbpeer, s); 460 if (size > sizeof(uint32_t) * 10) { 461 /* 462 * spice has 6 types as of 2021. Limiting to 10 entries 463 * so we we have some wiggle room. 464 */ >>> CID 1453266: Resource leaks (RESOURCE_LEAK) >>> Variable "info" going out of scope leaks the storage it points to. 465 return; 466 } 467 while (size >= sizeof(uint32_t)) { 468 trace_vdagent_cb_grab_type(GET_NAME(type_name, *(uint32_t *)data)); 469 switch (*(uint32_t *)data) { 470 case VD_AGENT_CLIPBOARD_UTF8_TEXT: Fixes: f0349f4d8947ad32d0fa4678cbf5dbb356fcbda1 ("ui/vdagent: add clipboard support") Reviewed-by: Gerd Hoffmann Signed-off-by: Stefan Hajnoczi Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth --- ui/vdagent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ui/vdagent.c b/ui/vdagent.c index a253a8fe63..8fc54d330e 100644 --- a/ui/vdagent.c +++ b/ui/vdagent.c @@ -456,7 +456,6 @@ static void vdagent_chr_recv_clipboard(VDAgentChardev *vd, VDAgentMessage *msg) switch (msg->type) { case VD_AGENT_CLIPBOARD_GRAB: trace_vdagent_cb_grab_selection(GET_NAME(sel_name, s)); - info = qemu_clipboard_info_new(&vd->cbpeer, s); if (size > sizeof(uint32_t) * 10) { /* * spice has 6 types as of 2021. Limiting to 10 entries @@ -464,6 +463,7 @@ static void vdagent_chr_recv_clipboard(VDAgentChardev *vd, VDAgentMessage *msg) */ return; } + info = qemu_clipboard_info_new(&vd->cbpeer, s); while (size >= sizeof(uint32_t)) { trace_vdagent_cb_grab_type(GET_NAME(type_name, *(uint32_t *)data)); switch (*(uint32_t *)data) {