Utkarsh Verma has uploaded a new patch set (#2). ( https://review.coreboot.org/c/coreboot/+/74129 )
Change subject: arch/x86/smbios: Avoid buffer overflows
......................................................................
arch/x86/smbios: Avoid buffer overflows
The format specifiers for numbers in snprintf() calls are updated to be
more specific to the data types used, making things more obvious for static
analysers.
This was found by coverity scan and raised in ticket #431:
https://scan6.scan.coverity.com/reports.htm#v55284/p10744
CID: 1487449
CID: 1487312
CID: 1487457
Found by: Coverity Scan
Signed-off-by: Utkarsh Verma <utkarsh(a)bitbanged.com>
Change-Id: I4391f8b44a7e0020a1f01cf0ed6ba75591c0e548
---
M src/arch/x86/smbios.c
M src/arch/x86/smbios_defaults.c
2 files changed, 31 insertions(+), 9 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/29/74129/2
--
To view, visit https://review.coreboot.org/c/coreboot/+/74129
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4391f8b44a7e0020a1f01cf0ed6ba75591c0e548
Gerrit-Change-Number: 74129
Gerrit-PatchSet: 2
Gerrit-Owner: Utkarsh Verma <utkarsh(a)bitbanged.com>
Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-MessageType: newpatchset
build bot (Jenkins) has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74129 )
Change subject: arch/x86/smbios: Avoid buffer overflows
......................................................................
Patch Set 1:
(1 comment)
Commit Message:
Robot Comment from checkpatch (run ID jenkins-coreboot-checkpatch-172871):
https://review.coreboot.org/c/coreboot/+/74129/comment/be064c73_4f02009a
PS1, Line 9: The format specifiers for numbers in snprintf() calls are updated to be
Possible unwrapped commit description (prefer a maximum 72 chars per line)
--
To view, visit https://review.coreboot.org/c/coreboot/+/74129
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I4391f8b44a7e0020a1f01cf0ed6ba75591c0e548
Gerrit-Change-Number: 74129
Gerrit-PatchSet: 1
Gerrit-Owner: Utkarsh Verma <utkarsh(a)bitbanged.com>
Gerrit-CC: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-Comment-Date: Sat, 01 Apr 2023 12:13:34 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Martin L Roth, Michael Niewöhner, Elyes Haouas.
Felix Singer has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74156 )
Change subject: util/crossgcc/buildgcc: Allow building CMake with multiple threads
......................................................................
Patch Set 1:
(1 comment)
Commit Message:
https://review.coreboot.org/c/coreboot/+/74156/comment/79ce7b14_88fa73f6
PS1, Line 7: Allow building CMake with multiple threads
> not exactly - `--parallel` for `configure` only influences threads of builds done during configure. […]
I have tested this before uploading the patch. `--parallel` also seems to configure the threads which are used during the compilation. With `--parallel=1` only one thread was used, while `--parallel=32` made it using 32 threads.
If there is a configure flag for it, I rather want to use that instead of `make -j`. Though, I have to say I didn't check what the flag does :)
--
To view, visit https://review.coreboot.org/c/coreboot/+/74156
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I89d6728a0985946b702f83770bedf767afb12690
Gerrit-Change-Number: 74156
Gerrit-PatchSet: 1
Gerrit-Owner: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Elyes Haouas <ehaouas(a)noos.fr>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-CC: Michael Niewöhner <foss(a)mniewoehner.de>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Attention: Michael Niewöhner <foss(a)mniewoehner.de>
Gerrit-Attention: Elyes Haouas <ehaouas(a)noos.fr>
Gerrit-Comment-Date: Sat, 01 Apr 2023 11:29:13 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Michael Niewöhner <foss(a)mniewoehner.de>
Gerrit-MessageType: comment
Attention is currently required from: Benjamin Doron, Paul Menzel, Maximilian Brune.
Angel Pons has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74121 )
Change subject: [RFC] drivers/option: Add option list in cbtable
......................................................................
Patch Set 1:
(4 comments)
File src/drivers/option/cfr.h:
https://review.coreboot.org/c/coreboot/+/74121/comment/aef47be3_c2194edc
PS1, Line 48: struct cfr_string {
: uint32_t length;
: uint8_t str[];
: };
Note: This cannot be a cbtables record because `length` does not store the actual length of the structure, but the length of the string. The structure is a bit longer, as it has some trailing bytes so that the next structure is aligned to `LB_ENTRY_ALIGN`.
https://review.coreboot.org/c/coreboot/+/74121/comment/4f0406f3_6186dd89
PS1, Line 56: /* struct cfr_string ui_name; */
These members are intentionally commented out so that `sizeof()` of this structure only contains the fields in the structure itself. Uncommenting this results in the `length` field of `cfr_string` getting counted twice (once in the `sizeof()` for this structure, once when writing the `cfr_string` structure).
Things get much worse when having multiple `cfr_string` members in a struct, because there's a flexible array member not at the end of the structure. Any members after a `cfr_string` member will have an invalid offset.
https://review.coreboot.org/c/coreboot/+/74121/comment/7ad3d2de_08d22cf9
PS1, Line 71: /* struct cfr_string opt_name; */
: /* struct cfr_string ui_name; */
: /* struct lb_cfr_enum_value enum_values[]; */
Might have a problem parsing these variable length fields because the length field of a `cfr_string` structure does not correspond to the actual size of the entire structure. Currently, anyone trying to parse these tables needs to know that the length field of a `cfr_string` needs to be aligned up to `LB_ENTRY_ALIGN` to find the next record.
For strings, we could make the length field store the aligned length (and maybe fill in the padding with zeroes so that weird things don't happen), but this won't work for byte buffers as there's no "NULL terminator" equivalent.
TL;DR it seems that the current approach is the simplest one, but this needs to be properly documented.
File src/drivers/option/cfr.c:
https://review.coreboot.org/c/coreboot/+/74121/comment/147968ce_9edc14b3
PS1, Line 19: uint32_t
> Any reason to limit the length?
cbtables records have a `uint32_t size;` field, and its width cannot be changed without breaking backwards compatibility. The values returned by this function are stored in these `size` fields, so it makes sense to limit the length accordingly.
[The rest of this comment is written in a jocular tone, and should not be taken personally]
Also, if your setup menu needs more than 4 GiB of RAM, you may have a problem... Several problems, actually:
- You'd need to have enough RAM to store all the data.
- A huge chunk of RAM that the OS can't use (it could be reclaimed if you're willing to open another can of worms).
- You'd need to put cbtables above 4 GiB, and you'd either need PAE (Physical Address Extension) or 64-bit coreboot to fill in the cbtables. You might need to do something to maintain backwards compatibility.
- Why is your setup menu so huge, are you trying to micromanage the hardware?
--
To view, visit https://review.coreboot.org/c/coreboot/+/74121
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I304de7d26d79245a2e31a6d01f6c5643b31cb772
Gerrit-Change-Number: 74121
Gerrit-PatchSet: 1
Gerrit-Owner: Angel Pons <th3fanbus(a)gmail.com>
Gerrit-Reviewer: Benjamin Doron <benjamin.doron00(a)gmail.com>
Gerrit-Reviewer: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Lean Sheng Tan <sheng.tan(a)9elements.com>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Benjamin Doron <benjamin.doron00(a)gmail.com>
Gerrit-Attention: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Maximilian Brune <maximilian.brune(a)9elements.com>
Gerrit-Comment-Date: Sat, 01 Apr 2023 11:24:45 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-MessageType: comment
Attention is currently required from: Utkarsh Verma.
Utkarsh Verma has uploaded a new patch set (#2). ( https://review.coreboot.org/c/coreboot/+/74128 )
Change subject: src/arc/x86/smbios.c: Fix coverity issues
......................................................................
src/arc/x86/smbios.c: Fix coverity issues
This commit serves to address the security issues raised by coverity in ticket #431. It changes the format specifiers from "%d" -> "%hhu" for the byte variables, preventing edge cases where buffer overflow could occur.
Change-Id: Ibbf93fd113791b6faa1e5128da8e692f7f00ac73
Signed-off-by: Utkarsh Verma <utkarsh(a)bitbanged.com>
---
M src/arch/x86/smbios.c
M src/arch/x86/smbios_defaults.c
2 files changed, 163 insertions(+), 191 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/28/74128/2
--
To view, visit https://review.coreboot.org/c/coreboot/+/74128
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ibbf93fd113791b6faa1e5128da8e692f7f00ac73
Gerrit-Change-Number: 74128
Gerrit-PatchSet: 2
Gerrit-Owner: Utkarsh Verma <utkarsh(a)bitbanged.com>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Utkarsh Verma <utkarsh(a)bitbanged.com>
Gerrit-MessageType: newpatchset
Attention is currently required from: Utkarsh Verma.
Paul Menzel has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74128 )
Change subject: src/arc/x86/smbios.c: Fix coverity issues
......................................................................
Patch Set 1:
(5 comments)
Commit Message:
https://review.coreboot.org/c/coreboot/+/74128/comment/523d2b4d_8d8cd0b2
PS1, Line 7: Fix coverity issues
Please make the commit message summary/title about the action/code change. Reading `git log --oneline` this summary is not so useful, and people need to look at the full commit message.
https://review.coreboot.org/c/coreboot/+/74128/comment/79041aba_fb6bc7f3
PS1, Line 7: src/arc/x86/smbios.c: Fix coverity issues
The prefix does not need to (and should not) be the path. Please use: *arch/x86/smbios*.
https://review.coreboot.org/c/coreboot/+/74128/comment/28a9ef23_93ef900b
PS1, Line 12: Closes #431
Please look through `git log --grep Found-by` how to reference Coverity issues.
Patchset:
PS1:
Welcome to coreboot! Working on Coverity issues is much appreciated. Some minor formal nits from my side. (If possible, please do not mix format changes with code changes.)
File src/arch/x86/smbios.c:
https://review.coreboot.org/c/coreboot/+/74128/comment/d2fbf884_ce21c3da
PS1, Line 22:
: #define update_max(len, max_len, stmt) \
: do { \
: int tmp = stmt; \
: max_len = MAX(max_len, tmp); \
: len += tmp; \
Separate unrelated change?
--
To view, visit https://review.coreboot.org/c/coreboot/+/74128
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ibbf93fd113791b6faa1e5128da8e692f7f00ac73
Gerrit-Change-Number: 74128
Gerrit-PatchSet: 1
Gerrit-Owner: Utkarsh Verma <utkarsh(a)bitbanged.com>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Utkarsh Verma <utkarsh(a)bitbanged.com>
Gerrit-Comment-Date: Sat, 01 Apr 2023 11:15:19 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Utkarsh Verma has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74128 )
Change subject: src/arc/x86/smbios.c: Fix coverity issues
......................................................................
Patch Set 1:
(1 comment)
This change is ready for review.
Patchset:
PS1:
These changes are with respect to Ticket 431. I have created a Google Sheet to track my progress as well. Please feel free to comment on it.
https://docs.google.com/spreadsheets/d/15o8avjO7zCQMKGbjcqdUk-OB1Ax--sEt7fl…
--
To view, visit https://review.coreboot.org/c/coreboot/+/74128
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ibbf93fd113791b6faa1e5128da8e692f7f00ac73
Gerrit-Change-Number: 74128
Gerrit-PatchSet: 1
Gerrit-Owner: Utkarsh Verma <utkarsh(a)bitbanged.com>
Gerrit-Comment-Date: Sat, 01 Apr 2023 11:13:50 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment
Attention is currently required from: Martin L Roth, ron minnich, Elyes Haouas.
Paul Menzel has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/74124 )
Change subject: Add support for rust
......................................................................
Patch Set 1:
(3 comments)
Commit Message:
https://review.coreboot.org/c/coreboot/+/74124/comment/ac742c31_0cb15c70
PS1, Line 7: Add support for rust
Please add prefix: *util/crossgcc* or *crossgcc*.
https://review.coreboot.org/c/coreboot/+/74124/comment/2f7cc383_ca8b080e
PS1, Line 9: This is what is done on oreboot. It is not clear
: that the four commands in the rule are strictly
: necessary.
Nit: Please use the fully allowed width of 72 characters. Then it fits into two lines.
Patchset:
PS1:
Before we add support for another language, could you please bring this up on the mailing list?
--
To view, visit https://review.coreboot.org/c/coreboot/+/74124
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings
Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: Ibff3ca83b3dfebcc18006cddf0f649bcfb076500
Gerrit-Change-Number: 74124
Gerrit-PatchSet: 1
Gerrit-Owner: ron minnich <rminnich(a)gmail.com>
Gerrit-Reviewer: Elyes Haouas <ehaouas(a)noos.fr>
Gerrit-Reviewer: Felix Singer <felixsinger(a)posteo.net>
Gerrit-Reviewer: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Reviewer: build bot (Jenkins) <no-reply(a)coreboot.org>
Gerrit-CC: Paul Menzel <paulepanter(a)mailbox.org>
Gerrit-Attention: Martin L Roth <gaumless(a)gmail.com>
Gerrit-Attention: ron minnich <rminnich(a)gmail.com>
Gerrit-Attention: Elyes Haouas <ehaouas(a)noos.fr>
Gerrit-Comment-Date: Sat, 01 Apr 2023 11:10:53 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Gerrit-MessageType: comment