Changeset 103684 in vbox

Timestamp:

Mar 5, 2024 3:27:02 PM (7 months ago)

Author:

vboxsync

Message:

Linux kernel modules: Fix UBSAN warnings by switching to flexible arrays where possible, bugref:10585.

Location:

trunk

Files:

• include/VBox/VBoxTpG.h (modified) (1 diff)
• include/VBox/sup.h (modified) (1 diff)
• src/VBox/HostDrivers/Support/SUPDrv.cpp (modified) (7 diffs)
• src/VBox/HostDrivers/Support/SUPDrvTracer.cpp (modified) (2 diffs)
• src/VBox/Runtime/r0drv/linux/memobj-r0drv-linux.c (modified) (1 diff)
• src/VBox/VMM/testcase/Makefile.kmk (modified) (1 diff)

trunk/include/VBox/VBoxTpG.h

@@ -229 +229 @@
     uint8_t         fHaveLargeArgs;
     uint8_t         abReserved[2];
-    VTGDESCARG      aArgs[1];
+    RT_FLEXIBLE_ARRAY_EXTENSION
+    VTGDESCARG      aArgs[RT_FLEXIBLE_ARRAY];
 } VTGDESCARGLIST;
 /** Pointer to a VTG argument list descriptor. */

trunk/include/VBox/sup.h

@@ -562 +562 @@
      * entry is updated. If @c u32Mode is SUPGIPMODE_SYNC_TSC the TSC frequency in
      * @c u64CpuHz is copied to all CPUs. */
-    SUPGIPCPU           aCPUs[1];
+    RT_FLEXIBLE_ARRAY_EXTENSION
+    SUPGIPCPU           aCPUs[RT_FLEXIBLE_ARRAY];
 } SUPGLOBALINFOPAGE;
 AssertCompileMemberAlignment(SUPGLOBALINFOPAGE, u64NanoTSLastUpdateHz, 8);

trunk/src/VBox/HostDrivers/Support/SUPDrv.cpp

@@ -1848 +1848 @@
             /* validate */
             PSUPLDRLOAD pReq = (PSUPLDRLOAD)pReqHdr;
+            uint8_t const * const pbSrcImage = pReq->u.In.abImage;
             REQ_CHECK_EXPR(Name, pReq->Hdr.cbIn >= SUP_IOCTL_LDR_LOAD_SIZE_IN(32));
             REQ_CHECK_SIZES_EX(SUP_IOCTL_LDR_LOAD, SUP_IOCTL_LDR_LOAD_SIZE_IN(pReq->u.In.cbImageWithEverything), SUP_IOCTL_LDR_LOAD_SIZE_OUT);
@@ -1876 +1877 @@
             {
                 uint32_t i;
-                PSUPLDRSYM paSyms = (PSUPLDRSYM)&pReq->u.In.abImage[pReq->u.In.offSymbols];
+                PSUPLDRSYM paSyms = (PSUPLDRSYM)(&pbSrcImage[pReq->u.In.offSymbols]);
                 for (i = 0; i < pReq->u.In.cSymbols; i++)
                 {
@@ -1883 +1884 @@
                     REQ_CHECK_EXPR_FMT(paSyms[i].offName < pReq->u.In.cbStrTab,
                                        ("SUP_IOCTL_LDR_LOAD: sym #%ld: name off %#lx (max=%#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithEverything));
-                    REQ_CHECK_EXPR_FMT(RTStrEnd((char const *)&pReq->u.In.abImage[pReq->u.In.offStrTab + paSyms[i].offName],
+                    REQ_CHECK_EXPR_FMT(RTStrEnd((char const *)(&pbSrcImage[pReq->u.In.offStrTab + paSyms[i].offName]),
                                                 pReq->u.In.cbStrTab - paSyms[i].offName),
                                        ("SUP_IOCTL_LDR_LOAD: sym #%ld: unterminated name! (%#lx / %#lx)\n", (long)i, (long)paSyms[i].offName, (long)pReq->u.In.cbImageWithEverything));
@@ -1891 +1892 @@
                 uint32_t i;
                 uint32_t offPrevEnd = 0;
-                PSUPLDRSEG paSegs = (PSUPLDRSEG)&pReq->u.In.abImage[pReq->u.In.offSegments];
+                PSUPLDRSEG paSegs = (PSUPLDRSEG)(&pbSrcImage[pReq->u.In.offSegments]);
                 for (i = 0; i < pReq->u.In.cSegments; i++)
                 {
@@ -5550 +5551 @@
     {
         size_t  cbSegments = pImage->cSegments * sizeof(SUPLDRSEG);
-        pImage->paSegments = (PSUPLDRSEG)RTMemDup(&pReq->u.In.abImage[pReq->u.In.offSegments], cbSegments);
+        uint8_t const * const pbSrcImage = pReq->u.In.abImage;
+        pImage->paSegments = (PSUPLDRSEG)RTMemDup(&pbSrcImage[pReq->u.In.offSegments], cbSegments);
         if (pImage->paSegments) /* Align the last segment size to avoid upsetting RTR0MemObjProtect. */ /** @todo relax RTR0MemObjProtect */
             pImage->paSegments[pImage->cSegments - 1].cb = RT_ALIGN_32(pImage->paSegments[pImage->cSegments - 1].cb, PAGE_SIZE);
@@ -5619 +5621 @@
     if (!pImage->fNative)
     {
+        uint8_t const * const pbSrcImage = pReq->u.In.abImage;
         pImage->cbStrTab = pReq->u.In.cbStrTab;
         if (pImage->cbStrTab)
         {
-            pImage->pachStrTab = (char *)RTMemDup(&pReq->u.In.abImage[pReq->u.In.offStrTab], pImage->cbStrTab);
+            pImage->pachStrTab = (char *)RTMemDup(&pbSrcImage[pReq->u.In.offStrTab], pImage->cbStrTab);
             if (!pImage->pachStrTab)
                 rc = supdrvLdrLoadError(VERR_NO_MEMORY, pReq, "Out of memory for string table: %#x", pImage->cbStrTab);
@@ -5632 +5635 @@
         {
             size_t  cbSymbols = pImage->cSymbols * sizeof(SUPLDRSYM);
-            pImage->paSymbols = (PSUPLDRSYM)RTMemDup(&pReq->u.In.abImage[pReq->u.In.offSymbols], cbSymbols);
+            pImage->paSymbols = (PSUPLDRSYM)RTMemDup(&pbSrcImage[pReq->u.In.offSymbols], cbSymbols);
             if (!pImage->paSymbols)
                 rc = supdrvLdrLoadError(VERR_NO_MEMORY, pReq, "Out of memory for symbol table: %#x", cbSymbols);

trunk/src/VBox/HostDrivers/Support/SUPDrvTracer.cpp

@@ -97 +97 @@
     bool                    fRegistered;
     /** The provider name (for logging purposes). */
-    char                    szName[1];
+    RT_FLEXIBLE_ARRAY_EXTENSION
+    char                    szName[RT_FLEXIBLE_ARRAY];
 } SUPDRVTPPROVIDER;
 /** Pointer to the data for a tracepoint provider. */
@@ -162 +163 @@
     uint32_t                cProbeLocs;
     /** Ring-0 probe location info. */
-    SUPDRVPROBELOC          aProbeLocs[1];
+    RT_FLEXIBLE_ARRAY_EXTENSION
+    SUPDRVPROBELOC          aProbeLocs[RT_FLEXIBLE_ARRAY];
 } SUPDRVTRACERUMOD;
 /** Magic value for SUPDRVVTGCOPY. */

trunk/src/VBox/Runtime/r0drv/linux/memobj-r0drv-linux.c

@@ -145 +145 @@
     size_t              cPages;
     /** Array of struct page pointers. (variable size) */
-    struct page        *apPages[1];
+    RT_FLEXIBLE_ARRAY_EXTENSION
+    struct page        *apPages[RT_FLEXIBLE_ARRAY];
 } RTR0MEMOBJLNX;
 /** Pointer to the linux memory object. */

trunk/src/VBox/VMM/testcase/Makefile.kmk

@@ -1094 +1094 @@
                 -e '/SUPDRVTRACERUSRCTX32_size$$/d' \
                 -e '/HMCPU_size$$/d' \
+                -e '/SUPGLOBALINFOPAGE_size$$/d' \
                 \
                 -e '/^\(0x\)\{0,1\}00[0-9a-fA-F]* [aAnN] [^_.]*_size$$/!d' \