QEMU With E2K User Support
Go to file
Marc-André Lureau 83e33300a2 crypto: fix stack-buffer-overflow error
ASAN complains about:

==8856==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd8a1fe168 at pc 0x561136cb4451 bp 0x7ffd8a1fe130 sp 0x7ffd8a1fd8e0
READ of size 16 at 0x7ffd8a1fe168 thread T0
    #0 0x561136cb4450 in __asan_memcpy (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x110450)
    #1 0x561136d2a6a7 in qcrypto_ivgen_essiv_calculate /home/elmarco/src/qq/crypto/ivgen-essiv.c:83:5
    #2 0x561136d29af8 in qcrypto_ivgen_calculate /home/elmarco/src/qq/crypto/ivgen.c:72:12
    #3 0x561136d07c8e in test_ivgen /home/elmarco/src/qq/tests/test-crypto-ivgen.c:148:5
    #4 0x7f77772c3b04 in test_case_run /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2237
    #5 0x7f77772c3ec4 in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2321
    #6 0x7f77772c3f6d in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333
    #7 0x7f77772c3f6d in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333
    #8 0x7f77772c3f6d in g_test_run_suite_internal /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333
    #9 0x7f77772c4184 in g_test_run_suite /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2408
    #10 0x7f77772c2e0d in g_test_run /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:1674
    #11 0x561136d0799b in main /home/elmarco/src/qq/tests/test-crypto-ivgen.c:173:12
    #12 0x7f77756e6039 in __libc_start_main (/lib64/libc.so.6+0x21039)
    #13 0x561136c13d89 in _start (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x6fd89)

Address 0x7ffd8a1fe168 is located in stack of thread T0 at offset 40 in frame
    #0 0x561136d2a40f in qcrypto_ivgen_essiv_calculate /home/elmarco/src/qq/crypto/ivgen-essiv.c:76

  This frame has 1 object(s):
    [32, 40) 'sector.addr' <== Memory access at offset 40 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x110450) in __asan_memcpy
Shadow bytes around the buggy address:
  0x100031437bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100031437c20: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00[f3]f3 f3
  0x100031437c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100031437c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

It looks like the rest of the code copes with ndata being larger than
sizeof(sector), so limit the memcpy() range.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <20180104160523.22995-13-marcandre.lureau@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2018-01-16 14:54:50 +01:00
accel Queued TCG patches 2018-01-08 16:17:04 +00:00
audio buildsys: Move audio libs to per object 2017-09-22 10:20:34 +08:00
backends tpm: tpm_emulator: get and set buffer size of device 2017-12-14 23:39:15 -05:00
block block/nbd: fix segmentation fault when .desc is not null-terminated 2018-01-08 09:12:23 -06:00
bsd-user misc: remove headers implicitly included 2017-12-18 17:07:02 +03:00
capstone@22ead3e0bf disas: Add capstone as submodule 2017-10-26 11:56:20 +02:00
chardev chardev: introduce qemu_chr_timeout_add_ms() 2018-01-12 13:22:02 +01:00
contrib contrib: add systemd unit files 2017-12-20 22:29:26 +01:00
crypto crypto: fix stack-buffer-overflow error 2018-01-16 14:54:50 +01:00
default-configs target-arm queue: 2018-01-11 14:34:41 +00:00
disas target/xtensa updates: 2018-01-09 18:23:27 +00:00
docs build-sys: add a rule to print a variable 2018-01-12 13:22:02 +01:00
dtc@e54388015a Update dtc to fix compilation problem on Mac OS 10.6 2018-01-10 12:53:00 +11:00
fpu
fsdev fsdev: improve error handling of backend init 2018-01-08 11:18:23 +01:00
gdb-xml
hw chardev: introduce qemu_chr_timeout_add_ms() 2018-01-12 13:22:02 +01:00
include readline: add a free function 2018-01-16 14:54:50 +01:00
io io: introduce a network socket listener API 2017-12-15 15:07:26 +00:00
libdecnumber build: remove CONFIG_LIBDECNUMBER 2017-10-16 18:03:52 +02:00
linux-headers linux-headers: update to 4.15-rc1 2017-12-13 17:59:23 +00:00
linux-user linux-user/arm/nwfpe: Check coprocessor number for FPA emulation 2018-01-11 13:25:39 +00:00
migration Remove empty statements 2017-12-18 17:07:02 +03:00
nbd nbd: rename nbd_option and nbd_opt_reply 2018-01-10 12:11:23 -06:00
net net: Remove the legacy "-net channel" parameter 2017-12-22 10:05:26 +08:00
pc-bios pseries: Update SLOF firmware image to qemu-slof-20171214 2018-01-10 12:52:59 +11:00
po
qapi block: Document that x-blockdev-change breaks quorum children list 2017-12-22 15:03:41 +01:00
qga sockets: remove obsolete code that updated listen address 2017-12-21 09:22:44 +01:00
qobject qapi: Add qobject_is_equal() 2017-11-17 18:21:30 +01:00
qom tcg: Add CPUState cflags_next_tb 2017-10-24 13:53:41 -07:00
replay migration: pre_save return int 2017-09-27 11:35:59 +01:00
roms pseries: Update SLOF firmware image to qemu-slof-20171214 2018-01-10 12:52:59 +11:00
scripts target-arm queue: 2018-01-11 14:34:41 +00:00
scsi scsi: fix scsi_convert_sense crash when in_buf == NULL && in_len == 0 2018-01-12 09:54:13 +01:00
slirp slirp: don't zero the whole ti_i when m == NULL 2017-11-09 18:59:22 +01:00
stubs tpm: add stubs 2017-10-25 01:05:04 -04:00
target i386/cpu/kvm: look at PMU's CPUID before setting MSRs 2018-01-12 13:22:02 +01:00
tcg tcg: Allow 6 arguments to TCG helpers 2017-12-29 12:43:40 -08:00
tests tests: fix migration-test leak 2018-01-16 14:54:50 +01:00
trace trace: Try using tracefs first 2017-12-18 14:37:36 +00:00
ui ui: generate qcode to linux mappings 2017-12-14 15:24:30 -08:00
util readline: add a free function 2018-01-16 14:54:50 +01:00
.dir-locals.el
.editorconfig
.exrc
.gdbinit
.gitignore .gitignore: remove vscclient 2017-12-18 17:07:02 +03:00
.gitmodules disas: Add capstone as submodule 2017-10-26 11:56:20 +02:00
.mailmap MAINTAINERS: Update Paul Burton's email address 2017-11-06 07:36:43 -08:00
.shippable.yml
.travis.yml
arch_init.c
balloon.c
block.c block: Keep nodes drained between reopen_queue/multiple 2017-12-22 15:05:32 +01:00
blockdev-nbd.c blockdev: convert internal NBD server to QIONetListener 2017-12-21 09:30:32 +01:00
blockdev.c block: Remove the obsolete -drive boot=on|off parameter 2017-12-22 15:03:41 +01:00
blockjob.c blockjob: Pause job on draining any job BDS 2017-12-22 15:05:32 +01:00
bootdevice.c
bt-host.c
bt-vhci.c all: Clean up includes 2016-02-04 17:41:30 +00:00
Changelog Use HTTPS for qemu.org and other domains 2017-11-21 13:34:13 +00:00
CODING_STYLE coding_style: add point about 0x in trace-events 2017-08-01 12:13:07 +01:00
configure build-sys: compile with -Og or -O1 when --enable-debug 2018-01-12 13:22:02 +01:00
COPYING
COPYING.LIB
COPYING.PYTHON scripts: add argparse module for Python 2.6 compatibility 2017-08-30 12:02:11 +01:00
cpus-common.c
cpus.c i386: hvf: add code base from Google's QEMU repository 2017-12-22 15:01:20 +01:00
device_tree.c
device-hotplug.c
disas.c disas: Dump insn bytes along with capstone disassembly 2017-11-09 08:46:38 +01:00
dma-helpers.c
dump.c dump: fix note_name_equal() 2018-01-02 14:49:54 +01:00
exec.c exec: Don't reuse unassigned_mem_ops for io_mem_rom 2017-12-21 09:30:32 +01:00
gdbstub.c gdbstub: add tracing 2017-12-18 14:37:36 +00:00
HACKING
hmp-commands-info.hx hmp-commands-info: Change "@findex FOO" to "@findex info FOO" 2017-10-05 10:08:39 +01:00
hmp-commands.hx hmp-commands: Remove the deprecated usb_add and usb_del 2017-12-14 10:16:52 +00:00
hmp.c block: Don't acquire AioContext in hmp_qemu_io() 2017-12-22 15:03:41 +01:00
hmp.h migrate: HMP migate_continue 2017-10-23 18:03:31 +02:00
ioport.c
iothread.c iothread: fix iothread_stop() race condition 2017-12-19 10:25:09 +00:00
LICENSE
MAINTAINERS ppc patch queue 2018-01-11 2018-01-11 13:24:17 +00:00
Makefile build-sys: add a rule to print a variable 2018-01-12 13:22:02 +01:00
Makefile.objs sparc64: introduce trace-events for hw/sparc64 2018-01-09 21:48:19 +00:00
Makefile.target Fix build of console and GUI executables for Windows 2017-11-23 10:46:42 +00:00
memory_ldst.inc.c
memory_mapping.c
memory.c memory: remove unused memory_region_set_global_locking() 2017-12-18 17:07:02 +03:00
module-common.c
monitor.c readline: add a free function 2018-01-16 14:54:50 +01:00
numa.c numa: remove unused #include 2017-12-18 17:07:02 +03:00
os-posix.c os-posix: Drop misleading comment 2017-10-16 21:01:37 +03:00
os-win32.c
qapi-schema.json qmp: remove qmp_cpu 2017-12-20 19:18:33 +01:00
qdev-monitor.c pci-assign: Remove 2017-11-05 14:52:10 +01:00
qdict-test-data.txt
qemu-bridge-helper.c
qemu-doc.texi hw/ppc: Remove the deprecated spapr-pci-vfio-host-bridge device 2018-01-10 12:53:00 +11:00
qemu-ga.texi
qemu-img-cmds.hx qemu-img: add --shrink flag for resize 2017-09-26 15:00:32 +02:00
qemu-img.c block: Add errp to bdrv_snapshot_goto() 2017-11-21 14:48:22 +01:00
qemu-img.texi qemu-img.1: Image invalidation on qemu-img commit 2017-10-26 14:59:18 +02:00
qemu-io-cmds.c block: Keep nodes drained between reopen_queue/multiple 2017-12-22 15:05:32 +01:00
qemu-io.c qemu-io: Add -C for opening with copy-on-read 2017-10-06 16:28:58 +02:00
qemu-keymap.c tools: add qemu-keymap 2017-10-16 14:50:54 +02:00
qemu-nbd.c blockdev: convert qemu-nbd server to QIONetListener 2017-12-21 09:30:32 +01:00
qemu-nbd.texi
qemu-option-trace.texi
qemu-options-wrapper.h qemu-options: Remove stray colons from output of --help 2017-12-20 09:04:27 +01:00
qemu-options.h
qemu-options.hx Block layer patches 2018-01-08 13:44:01 +00:00
qemu-seccomp.c seccomp: add resourcecontrol argument to command line 2017-09-15 10:15:06 +02:00
qemu-tech.texi
qemu.nsi Use HTTPS for qemu.org and other domains 2017-11-21 13:34:13 +00:00
qemu.sasl
qmp.c qmp: remove qmp_cpu 2017-12-20 19:18:33 +01:00
qtest.c qtest: Don't perform side effects inside assertion 2017-09-15 09:05:19 +02:00
README Use HTTPS for qemu.org and other domains 2017-11-21 13:34:13 +00:00
replication.c
replication.h
rules.mak build-sys: silence make by default or V=0 2018-01-12 13:22:02 +01:00
thunk.c
tpm.c tpm: remove tpm_register_model() 2017-12-14 23:39:15 -05:00
trace-events gdbstub: add tracing 2017-12-18 14:37:36 +00:00
VERSION Open 2.12 development tree 2017-12-13 17:05:59 +00:00
version.rc Use HTTPS for qemu.org and other domains 2017-11-21 13:34:13 +00:00
vl.c vl: fix direct firmware directories leak 2018-01-16 14:54:50 +01:00

         QEMU README
         ===========

QEMU is a generic and open source machine & userspace emulator and
virtualizer.

QEMU is capable of emulating a complete machine in software without any
need for hardware virtualization support. By using dynamic translation,
it achieves very good performance. QEMU can also integrate with the Xen
and KVM hypervisors to provide emulated hardware while allowing the
hypervisor to manage the CPU. With hypervisor support, QEMU can achieve
near native performance for CPUs. When QEMU emulates CPUs directly it is
capable of running operating systems made for one machine (e.g. an ARMv7
board) on a different machine (e.g. an x86_64 PC board).

QEMU is also capable of providing userspace API virtualization for Linux
and BSD kernel interfaces. This allows binaries compiled against one
architecture ABI (e.g. the Linux PPC64 ABI) to be run on a host using a
different architecture ABI (e.g. the Linux x86_64 ABI). This does not
involve any hardware emulation, simply CPU and syscall emulation.

QEMU aims to fit into a variety of use cases. It can be invoked directly
by users wishing to have full control over its behaviour and settings.
It also aims to facilitate integration into higher level management
layers, by providing a stable command line interface and monitor API.
It is commonly invoked indirectly via the libvirt library when using
open source applications such as oVirt, OpenStack and virt-manager.

QEMU as a whole is released under the GNU General Public License,
version 2. For full licensing details, consult the LICENSE file.


Building
========

QEMU is multi-platform software intended to be buildable on all modern
Linux platforms, OS-X, Win32 (via the Mingw64 toolchain) and a variety
of other UNIX targets. The simple steps to build QEMU are:

  mkdir build
  cd build
  ../configure
  make

Additional information can also be found online via the QEMU website:

  https://qemu.org/Hosts/Linux
  https://qemu.org/Hosts/Mac
  https://qemu.org/Hosts/W32


Submitting patches
==================

The QEMU source code is maintained under the GIT version control system.

   git clone git://git.qemu.org/qemu.git

When submitting patches, the preferred approach is to use 'git
format-patch' and/or 'git send-email' to format & send the mail to the
qemu-devel@nongnu.org mailing list. All patches submitted must contain
a 'Signed-off-by' line from the author. Patches should follow the
guidelines set out in the HACKING and CODING_STYLE files.

Additional information on submitting patches can be found online via
the QEMU website

  https://qemu.org/Contribute/SubmitAPatch
  https://qemu.org/Contribute/TrivialPatches


Bug reporting
=============

The QEMU project uses Launchpad as its primary upstream bug tracker. Bugs
found when running code built from QEMU git or upstream released sources
should be reported via:

  https://bugs.launchpad.net/qemu/

If using QEMU via an operating system vendor pre-built binary package, it
is preferable to report bugs to the vendor's own bug tracker first. If
the bug is also known to affect latest upstream code, it can also be
reported via launchpad.

For additional information on bug reporting consult:

  https://qemu.org/Contribute/ReportABug


Contact
=======

The QEMU community can be contacted in a number of ways, with the two
main methods being email and IRC

 - qemu-devel@nongnu.org
   https://lists.nongnu.org/mailman/listinfo/qemu-devel
 - #qemu on irc.oftc.net

Information on additional methods of contacting the community can be
found online via the QEMU website:

  https://qemu.org/Contribute/StartHere

-- End