[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[xen master] x86/hvm: Fix UBSAN failure in do_hvm_op() printk



commit 9d701bc9abaf1e9ab458545a8f320d36dc54d686
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Tue Jan 30 18:13:14 2024 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Thu Feb 1 19:52:44 2024 +0000

    x86/hvm: Fix UBSAN failure in do_hvm_op() printk
    
    Tamas reported this UBSAN failure from fuzzing:
    
      (XEN) 
================================================================================
      (XEN) UBSAN: Undefined behaviour in common/vsprintf.c:64:19
      (XEN) negation of -9223372036854775808 cannot be represented in type 
'long long int':
      (XEN) ----[ Xen-4.19-unstable  x86_64  debug=y ubsan=y  Not tainted ]----
      ...
      (XEN) Xen call trace:
      (XEN)    [<ffff82d040307c1c>] R ubsan.c#ubsan_epilogue+0xa/0xd9
      (XEN)    [<ffff82d04030805d>] F __ubsan_handle_negate_overflow+0x99/0xce
      (XEN)    [<ffff82d04028868f>] F vsprintf.c#number+0x10a/0x93e
      (XEN)    [<ffff82d04028ac74>] F vsnprintf+0x19e2/0x1c56
      (XEN)    [<ffff82d04030a47a>] F console.c#vprintk_common+0x76/0x34d
      (XEN)    [<ffff82d04030a79e>] F printk+0x4d/0x4f
      (XEN)    [<ffff82d04040c42b>] F do_hvm_op+0x288e/0x28f5
      (XEN)    [<ffff82d04040d385>] F hvm_hypercall+0xad2/0x149a
      (XEN)    [<ffff82d0403cd072>] F vmx_vmexit_handler+0x1596/0x279c
      (XEN)    [<ffff82d0403d909b>] F vmx_asm_vmexit_handler+0xdb/0x200
    
    The problem is an unsigned -> signed converstion because of a bad
    formatter (%ld trying to format an unsigned long).
    
    We could fix it by swapping to %lu, but this is a useless printk() even in
    debug builds, so just drop it completely.
    
    Reported-by: Tamas K Lengyel <tamas@xxxxxxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/arch/x86/hvm/hvm.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index e3bd9157d7..e8deeb0222 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -5147,12 +5147,9 @@ long do_hvm_op(unsigned long op, 
XEN_GUEST_HANDLE_PARAM(void) arg)
         break;
 
     default:
-    {
-        gdprintk(XENLOG_DEBUG, "Bad HVM op %ld.\n", op);
         rc = -ENOSYS;
         break;
     }
-    }
 
     if ( rc == -ERESTART )
         rc = hypercall_create_continuation(__HYPERVISOR_hvm_op, "lh",
--
generated by git-patchbot for /home/xen/git/xen.git#master



 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.