[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 14/15] virtio-serial: Handle scatter-gather buffers
From: |
Amit Shah |
Subject: |
[Qemu-devel] [PATCH 14/15] virtio-serial: Handle scatter-gather buffers for control messages |
Date: |
Wed, 24 Mar 2010 20:19:32 +0530 |
Current control messages are small enough to not be split into multiple
buffers but we could run into such a situation in the future or a
malicious guest could cause such a situation.
So handle the entire iov request for control messages.
Also ensure the size of the control request is >= what we expect
otherwise we risk accessing memory that we don't own.
Signed-off-by: Amit Shah <address@hidden>
CC: Avi Kivity <address@hidden>
Reported-by: Avi Kivity <address@hidden>
---
hw/virtio-serial-bus.c | 34 +++++++++++++++++++++++++++++++---
1 files changed, 31 insertions(+), 3 deletions(-)
diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index bd1223e..3edfeca 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -216,7 +216,7 @@ static void mon_event(const char *device, const uint32_t
port_id,
}
/* Guest wants to notify us of some event */
-static void handle_control_message(VirtIOSerial *vser, void *buf)
+static void handle_control_message(VirtIOSerial *vser, void *buf, size_t len)
{
struct VirtIOSerialPort *port;
struct virtio_console_control cpkt, *gcpkt;
@@ -225,6 +225,11 @@ static void handle_control_message(VirtIOSerial *vser,
void *buf)
gcpkt = buf;
+ if (len < sizeof(cpkt)) {
+ /* The guest sent an invalid control packet */
+ return;
+ }
+
cpkt.event = lduw_p(&gcpkt->event);
cpkt.value = lduw_p(&gcpkt->value);
@@ -321,12 +326,35 @@ static void control_out(VirtIODevice *vdev, VirtQueue *vq)
{
VirtQueueElement elem;
VirtIOSerial *vser;
+ uint8_t *buf;
+ size_t len;
vser = DO_UPCAST(VirtIOSerial, vdev, vdev);
+ len = 0;
+ buf = NULL;
while (virtqueue_pop(vq, &elem)) {
- handle_control_message(vser, elem.out_sg[0].iov_base);
- virtqueue_push(vq, &elem, elem.out_sg[0].iov_len);
+ size_t cur_len, copied;
+
+ cur_len = iov_size(elem.out_sg, elem.out_num);
+ /*
+ * Allocate a new buf only if we didn't have one previously or
+ * if the size of the buf differs
+ */
+ if (cur_len != len) {
+ if (len) {
+ qemu_free(buf);
+ }
+ buf = qemu_malloc(cur_len);
+ len = cur_len;
+ }
+ copied = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, len);
+
+ handle_control_message(vser, buf, copied);
+ virtqueue_push(vq, &elem, copied);
+ }
+ if (len) {
+ qemu_free(buf);
}
virtio_notify(vdev, vq);
}
--
1.6.2.5
- [Qemu-devel] [PATCH 04/15] virtio-serial: save/load: Send target host connection status if different, (continued)
- [Qemu-devel] [PATCH 04/15] virtio-serial: save/load: Send target host connection status if different, Amit Shah, 2010/03/24
- [Qemu-devel] [PATCH 05/15] virtio-serial: Use control messages to notify guest of new ports, Amit Shah, 2010/03/24
- [Qemu-devel] [PATCH 06/15] virtio-serial: whitespace: match surrounding code, Amit Shah, 2010/03/24
- [Qemu-devel] [PATCH 07/15] virtio-serial: Remove redundant check for 0-sized write request, Amit Shah, 2010/03/24
- [Qemu-devel] [PATCH 08/15] virtio-serial: Update copyright year to 2010, Amit Shah, 2010/03/24
- [Qemu-devel] [PATCH 09/15] virtio-serial: Propagate errors in initialising ports / devices in guest, Amit Shah, 2010/03/24
- [Qemu-devel] [PATCH 10/15] virtio-serial: Add QMP events for failed port/device add, Amit Shah, 2010/03/24
- [Qemu-devel] [PATCH 11/15] virtio-serial: Send out guest data to ports only if port is opened, Amit Shah, 2010/03/24
- [Qemu-devel] [PATCH 12/15] iov: Introduce a new file for helpers around iovs, add iov_from_buf(), Amit Shah, 2010/03/24
- [Qemu-devel] [PATCH 13/15] iov: Add iov_to_buf and iov_size helpers, Amit Shah, 2010/03/24
- [Qemu-devel] [PATCH 14/15] virtio-serial: Handle scatter-gather buffers for control messages,
Amit Shah <=
- [Qemu-devel] [PATCH 15/15] virtio-serial: Handle scatter/gather input from the guest, Amit Shah, 2010/03/24
- [Qemu-devel] Re: [PATCH 14/15] virtio-serial: Handle scatter-gather buffers for control messages, Juan Quintela, 2010/03/30
- [Qemu-devel] Re: [PATCH 14/15] virtio-serial: Handle scatter-gather buffers for control messages, Amit Shah, 2010/03/30
- [Qemu-devel] Re: [PATCH 10/15] virtio-serial: Add QMP events for failed port/device add, Luiz Capitulino, 2010/03/24
- [Qemu-devel] Re: [PATCH 10/15] virtio-serial: Add QMP events for failed port/device add, Amit Shah, 2010/03/24
- [Qemu-devel] Re: [PATCH 10/15] virtio-serial: Add QMP events for failed port/device add, Luiz Capitulino, 2010/03/25
- Re: [Qemu-devel] Re: [PATCH 10/15] virtio-serial: Add QMP events for failed port/device add, Jamie Lokier, 2010/03/25
- Re: [Qemu-devel] Re: [PATCH 10/15] virtio-serial: Add QMP events for failed port/device add, Amit Shah, 2010/03/25
- Re: [Qemu-devel] Re: [PATCH 10/15] virtio-serial: Add QMP events for failed port/device add, Jamie Lokier, 2010/03/26
- Re: [Qemu-devel] Re: [PATCH 10/15] virtio-serial: Add QMP events for failed port/device add, Amit Shah, 2010/03/26