[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v3 1/4] virtio-9p: record element after sanity c
From: |
Michael S. Tsirkin |
Subject: |
Re: [Qemu-devel] [PATCH v3 1/4] virtio-9p: record element after sanity checks |
Date: |
Thu, 22 Jun 2017 01:06:24 +0300 |
On Wed, Jun 21, 2017 at 07:41:58PM +0200, Greg Kurz wrote:
> If the guest sends a malformed request, we end up with a dangling pointer
> in V9fsVirtioState. This doesn't seem to cause any bug, but let's remove
> this side effect anyway.
>
> Signed-off-by: Greg Kurz <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
> ---
> hw/9pfs/virtio-9p-device.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
> index 245abd8aaef1..3380bfc0c551 100644
> --- a/hw/9pfs/virtio-9p-device.c
> +++ b/hw/9pfs/virtio-9p-device.c
> @@ -61,7 +61,6 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue
> *vq)
> }
> QEMU_BUILD_BUG_ON(sizeof(out) != 7);
>
> - v->elems[pdu->idx] = elem;
> len = iov_to_buf(elem->out_sg, elem->out_num, 0,
> &out, sizeof(out));
> if (len != sizeof(out)) {
> @@ -70,6 +69,8 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue
> *vq)
> goto out_free_req;
> }
>
> + v->elems[pdu->idx] = elem;
> +
> pdu_submit(pdu, &out);
> }
>