Changeset 107605 in vbox

Timestamp:

Jan 9, 2025 5:32:38 PM (3 months ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

166685

Message:

Additions: Linux: vboxvideo: Additional fix for UBSAN warnings, bugref:10585.

Location:

trunk

Files:

• include/VBox/Graphics/VBoxVideoErr.h (modified) (1 diff)
• src/VBox/Additions/common/VBoxVideo/HGSMIBase.cpp (modified) (1 diff)
• src/VBox/Additions/common/VBoxVideo/VBVABase.cpp (modified) (2 diffs)
• src/VBox/Additions/linux/drm/Makefile.module.kms (modified) (1 diff)

trunk/include/VBox/Graphics/VBoxVideoErr.h

@@ -74 +74 @@
 /** @}  */
 
+/** @def RT_BCOPY_UNFORTIFIED
+ * For copying a number of bytes from/to variable length structures.
+ *
+ * This is for working around false positives ("field-spanning writes") in the
+ * linux kernel's fortified memcpy (v5.18+) when copying from/to
+ * RT_FLEXIBLE_ARRAY fields and similar tricks going beyond the strict
+ * definition of a target or source structure.
+ *
+ * @param   a_pDst          Pointer to the destination buffer.
+ * @param   a_pSrc          Pointer to the source buffer.
+ * @param   a_cbToCopy      Number of bytes to copy.
+ * @see @bugref{10209}, @ticketref{21410}
+ */
+#if defined(RT_OS_LINUX) && defined(__KERNEL__)
+/* The definition of RT_BCOPY_UNFORTIFIED macro originally comes from IPRT
+ * header file. However, due to vboxvideo (Linux/DRM module) implementation,
+ * those header files cannot be used directly. Therefore, let's duplicate this
+ * definition here. Following vbox_drv.h header file is a part of
+ * vboxvideo sources, so this code block is only intended to be used from there. */
+# include "vbox_drv.h"
+# if (RTLNX_VER_MIN(5,18,0) || RTLNX_RHEL_RANGE(9,3, 9,99)) \
+  && !defined(__NO_FORTIFY) \
+  && defined(__OPTIMIZE__) \
+  && defined(CONFIG_FORTIFY_SOURCE)
+#  define RT_BCOPY_UNFORTIFIED(a_pDst, a_pSrc, a_cbToCopy)  __underlying_memcpy((a_pDst), (a_pSrc), (a_cbToCopy))
+# else
+#  define RT_BCOPY_UNFORTIFIED(a_pDst, a_pSrc, a_cbToCopy)  memcpy((a_pDst), (a_pSrc), (a_cbToCopy))
+# endif
+#else  /* !RT_OS_LINUX && !__KERNEL__ */
+# define RT_BCOPY_UNFORTIFIED(a_pDst, a_pSrc, a_cbToCopy)   memcpy((a_pDst), (a_pSrc), (a_cbToCopy))
+#endif /* !RT_OS_LINUX && !__KERNEL__ */
+
 #endif /* !VBOX_INCLUDED_Graphics_VBoxVideoErr_h */

trunk/src/VBox/Additions/common/VBoxVideo/HGSMIBase.cpp

@@ -233 +233 @@
     if (cbPixels)
         /* Copy the actual pointer data. */
-        memcpy (p->au8Data, pPixels, cbPixels);
+        RT_BCOPY_UNFORTIFIED(p->au8Data, pPixels, cbPixels);
     /* No need to check that the buffer is valid as we have just allocated it. */
     VBoxHGSMIBufferSubmit(pCtx, p);

trunk/src/VBox/Additions/common/VBoxVideo/VBVABase.cpp

@@ -253 +253 @@
     VBVABUFFER *pVBVA = pCtx->pVBVA;
     uint32_t u32BytesTillBoundary = pVBVA->cbData - offset;
-    uint8_t  *dst                 = &pVBVA->au8Data[offset];
+    uint8_t  *dst                 = &pVBVA->au8Data[0] + offset;
     int32_t i32Diff               = cb - u32BytesTillBoundary;
 
@@ -259 +259 @@
     {
         /* Chunk will not cross buffer boundary. */
-        memcpy (dst, p, cb);
+        RT_BCOPY_UNFORTIFIED(dst, p, cb);
     }
     else
     {
         /* Chunk crosses buffer boundary. */
-        memcpy (dst, p, u32BytesTillBoundary);
-        memcpy (&pVBVA->au8Data[0], (uint8_t *)p + u32BytesTillBoundary, i32Diff);
+        RT_BCOPY_UNFORTIFIED(dst, p, u32BytesTillBoundary);
+        RT_BCOPY_UNFORTIFIED(&pVBVA->au8Data[0], (uint8_t *)p + u32BytesTillBoundary, i32Diff);
     }
 }

trunk/src/VBox/Additions/linux/drm/Makefile.module.kms

@@ -45 +45 @@
 
 VBOXMOD_NAME = vboxvideo
+VBOXMOD_CFLAGS = -DRT_OS_LINUX
 VBOXMOD_OBJS = \
         hgsmi_base.o \