[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 53/81] virtio: fix up max size checks
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 53/81] virtio: fix up max size checks |
Date: |
Mon, 20 Mar 2017 18:08:17 -0500 |
From: "Michael S. Tsirkin" <address@hidden>
Coverity reports that ARRAY_SIZE(elem->out_sg) (and all the others too)
is wrong because elem->out_sg is a pointer.
However, the check is not in the right place and the max_size argument
of virtqueue_map_iovec can be removed. The check on in_num/out_num
should be moved to qemu_get_virtqueue_element instead, before the call
to virtqueue_alloc_element.
Cc: address@hidden
Reported-by: Paolo Bonzini <address@hidden>
Fixes: 3724650db07057333879484c8bc7d900b5c1bf8e ("virtio: introduce
virtqueue_alloc_element")
Signed-off-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Cornelia Huck <address@hidden>
(cherry picked from commit 6bdc21c050a2a7b92cbbd0b2a1f8934e9b5f896f)
* dropped context dep on 8607f5c30
Signed-off-by: Michael Roth <address@hidden>
---
hw/virtio/virtio.c | 30 +++++++++++++-----------------
1 file changed, 13 insertions(+), 17 deletions(-)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index e37641a..6dfc92f 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -592,24 +592,12 @@ static void virtqueue_undo_map_desc(unsigned int out_num,
unsigned int in_num,
}
static void virtqueue_map_iovec(struct iovec *sg, hwaddr *addr,
- unsigned int *num_sg, unsigned int max_size,
+ unsigned int *num_sg,
int is_write)
{
unsigned int i;
hwaddr len;
- /* Note: this function MUST validate input, some callers
- * are passing in num_sg values received over the network.
- */
- /* TODO: teach all callers that this can fail, and return failure instead
- * of asserting here.
- * When we do, we might be able to re-enable NDEBUG below.
- */
-#ifdef NDEBUG
-#error building with NDEBUG is not supported
-#endif
- assert(*num_sg <= max_size);
-
for (i = 0; i < *num_sg; i++) {
len = sg[i].iov_len;
sg[i].iov_base = cpu_physical_memory_map(addr[i], &len, is_write);
@@ -626,10 +614,8 @@ static void virtqueue_map_iovec(struct iovec *sg, hwaddr
*addr,
void virtqueue_map(VirtQueueElement *elem)
{
- virtqueue_map_iovec(elem->in_sg, elem->in_addr, &elem->in_num,
- VIRTQUEUE_MAX_SIZE, 1);
- virtqueue_map_iovec(elem->out_sg, elem->out_addr, &elem->out_num,
- VIRTQUEUE_MAX_SIZE, 0);
+ virtqueue_map_iovec(elem->in_sg, elem->in_addr, &elem->in_num, 1);
+ virtqueue_map_iovec(elem->out_sg, elem->out_addr, &elem->out_num, 0);
}
static void *virtqueue_alloc_element(size_t sz, unsigned out_num, unsigned
in_num)
@@ -790,6 +776,16 @@ void *qemu_get_virtqueue_element(QEMUFile *f, size_t sz)
qemu_get_buffer(f, (uint8_t *)&data, sizeof(VirtQueueElementOld));
+ /* TODO: teach all callers that this can fail, and return failure instead
+ * of asserting here.
+ * When we do, we might be able to re-enable NDEBUG below.
+ */
+#ifdef NDEBUG
+#error building with NDEBUG is not supported
+#endif
+ assert(ARRAY_SIZE(data.in_addr) >= data.in_num);
+ assert(ARRAY_SIZE(data.out_addr) >= data.out_num);
+
elem = virtqueue_alloc_element(sz, data.out_num, data.in_num);
elem->index = data.index;
--
2.7.4
- [Qemu-devel] [PATCH 30/81] 9pfs: fix fd leak in local_opendir(), (continued)
- [Qemu-devel] [PATCH 30/81] 9pfs: fix fd leak in local_opendir(), Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 33/81] 9pfs: fix O_PATH build break with older glibc versions, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 36/81] balloon: Don't balloon roms, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 46/81] exec: Add missing rcu_read_unlock, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 38/81] virtio: fix vq->inuse recalc after migr, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 43/81] ui/vnc: Fix problem with sending too many bytes as server name, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 50/81] tcg/aarch64: Fix addsub2 for 0+C, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 40/81] pc: fix crash in rtc_set_memory() if initial cpu is marked as hotplugged, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 45/81] virtio-crypto: fix possible integer and heap overflow, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 48/81] x86: ioapic: fix fail migration when irqchip=split, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 53/81] virtio: fix up max size checks,
Michael Roth <=
- [Qemu-devel] [PATCH 35/81] machine: Convert abstract typename on compat_props to subclass names, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 34/81] 9pfs: fix vulnerability in openat_dir() and local_unlinkat_common(), Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 47/81] display: cirrus: ignore source pitch value as needed in blit_is_unsafe, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 04/81] 9pfs: introduce relative_openat_nofollow() helper, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 60/81] s390x/kvm: fix small race reboot vs. cmma, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 57/81] cpu-exec: fix icount out-of-bounds access, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 54/81] block/iscsi: avoid data corruption with cache=writeback, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 58/81] ahci: advertise HOST_CAP_64, Michael Roth, 2017/03/20
- [Qemu-devel] [PATCH 62/81] block/nfs: fix naming of runtime opts, Michael Roth, 2017/03/20