Re: [Xen-devel] [PATCH 03/10] tools/insn-fuzz: Don't use memcpy() for zero-length reads

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 27/03/17 12:36, Jan Beulich wrote:
>>>> On 27.03.17 at 11:56, <andrew.cooper3@xxxxxxxxxx> wrote:
>> For control-flow changes, the emulator needs to perform a zero-length
>> instruction fetch at the target offset.  It also passes NULL for the
>> destination buffer, as there is no instruction stream to collect.
>>
>> This trips up UBSAN, even with a size of 0.  Exclude zero-length reads from
>> using memcpy(), rather than excluding NULL destination pointers, to still
>> catch unintentional uses of NULL.
>>
>> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
>> ---
>> CC: Jan Beulich <JBeulich@xxxxxxxx>
>> CC: George Dunlap <george.dunlap@xxxxxxxxxxxxx>
>> CC: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
>> CC: Wei Liu <wei.liu2@xxxxxxxxxx>
>> ---
>>  tools/fuzz/x86_instruction_emulator/fuzz-emul.c | 2 +-
> Btw., shouldn't this entire directory, just like tools/tests/x86_emulator/,
> fall under X86 in ./MAINTAINERS?

Yes probably.  I will adjust that in v2.

>
>> --- a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
>> +++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c
>> @@ -77,7 +77,7 @@ static int data_read(const char *why, void *dst, unsigned 
>> int bytes)
>>      else
>>          rc = maybe_fail(why, true);
>>  
>> -    if ( rc == X86EMUL_OKAY )
>> +    if ( rc == X86EMUL_OKAY && bytes )
> So if we really want to work around this oddity, then I think we want
> - a comment here
> - the check moved into fuzz_insn_fetch()

Ok.

~Andrew

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel