| Submitter | Daniel P. Berrange |
|---|---|
| Date | Sept. 29, 2011, 10:33 a.m. |
| Message ID | <1317292424-12239-1-git-send-email-berrange@redhat.com> |
| Download | mbox | patch |
| Permalink | /patch/116931/ |
| State | New |
| Headers | show |
Comments
On Thu, 29 Sep 2011 11:33:44 +0100, "Daniel P. Berrange" <berrange@redhat.com> wrote: > From: "Daniel P. Berrange" <berrange@redhat.com> > > If the 9pfs mount tag is longer than MAX_TAG_LEN bytes, rather than > silently truncating the tag which will likely break the guest OS, > report an immediate error and exit QEMU > > * hw/9pfs/virtio-9p-device.c: Report error & exit if mount tag is > too long > > Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Applied to the VirtFS (git://repo.or.cz/qemu/v9fs.git). I have to apply by hand, because it didn't apply cleanly. I also fixed checkpatch.pl errors. > --- > hw/9pfs/virtio-9p-device.c | 4 +++- > 1 files changed, 3 insertions(+), 1 deletions(-) > > diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c > index 97f2da5..8ca38d3 100644 > --- a/hw/9pfs/virtio-9p-device.c > +++ b/hw/9pfs/virtio-9p-device.c > @@ -117,7 +117,9 @@ VirtIODevice *virtio_9p_init(DeviceState *dev, V9fsConf *conf) > s->ctx.fs_root = g_strdup(fse->path); > len = strlen(conf->tag); > if (len > MAX_TAG_LEN) { > - len = MAX_TAG_LEN; > + fprintf(stderr, "mount tag '%s' (%d bytes) is longer than maximum (%d bytes)", > + conf->tag, len, MAX_TAG_LEN); > + exit(1); > } > /* s->tag is non-NULL terminated string */ > s->tag = g_malloc(len); > -- > 1.7.6.2 > > -aneesh
Patch
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c index 97f2da5..8ca38d3 100644 --- a/hw/9pfs/virtio-9p-device.c +++ b/hw/9pfs/virtio-9p-device.c @@ -117,7 +117,9 @@ VirtIODevice *virtio_9p_init(DeviceState *dev, V9fsConf *conf) s->ctx.fs_root = g_strdup(fse->path); len = strlen(conf->tag); if (len > MAX_TAG_LEN) { - len = MAX_TAG_LEN; + fprintf(stderr, "mount tag '%s' (%d bytes) is longer than maximum (%d bytes)", + conf->tag, len, MAX_TAG_LEN); + exit(1); } /* s->tag is non-NULL terminated string */ s->tag = g_malloc(len);