From patchwork Tue Mar 26 17:09:06 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cornelia Huck X-Patchwork-Id: 231480 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 5FEF92C009F for ; Wed, 27 Mar 2013 04:09:53 +1100 (EST) Received: from localhost ([::1]:33100 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UKXNc-0008Em-Nt for incoming@patchwork.ozlabs.org; Tue, 26 Mar 2013 13:09:48 -0400 Received: from eggs.gnu.org ([208.118.235.92]:32836) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UKXNB-0008E9-D9 for qemu-devel@nongnu.org; Tue, 26 Mar 2013 13:09:22 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UKXN8-0007R6-OP for qemu-devel@nongnu.org; Tue, 26 Mar 2013 13:09:21 -0400 Received: from e06smtp15.uk.ibm.com ([195.75.94.111]:59656) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UKXN8-0007Qf-Gc for qemu-devel@nongnu.org; Tue, 26 Mar 2013 13:09:18 -0400 Received: from /spool/local by e06smtp15.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 26 Mar 2013 17:06:44 -0000 Received: from d06dlp03.portsmouth.uk.ibm.com (9.149.20.15) by e06smtp15.uk.ibm.com (192.168.101.145) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 26 Mar 2013 17:06:42 -0000 Received: from b06cxnps4075.portsmouth.uk.ibm.com (d06relay12.portsmouth.uk.ibm.com [9.149.109.197]) by d06dlp03.portsmouth.uk.ibm.com (Postfix) with ESMTP id A90BD1B08070; Tue, 26 Mar 2013 17:09:13 +0000 (GMT) Received: from d06av10.portsmouth.uk.ibm.com (d06av10.portsmouth.uk.ibm.com [9.149.37.251]) by b06cxnps4075.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r2QH93h554591742; Tue, 26 Mar 2013 17:09:03 GMT Received: from d06av10.portsmouth.uk.ibm.com (loopback [127.0.0.1]) by d06av10.portsmouth.uk.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id r2QFmYth015737; Tue, 26 Mar 2013 11:48:35 -0400 Received: from gondolin.boeblingen.de.ibm.com (dyn-9-152-224-122.boeblingen.de.ibm.com [9.152.224.122]) by d06av10.portsmouth.uk.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id r2QFmXWO015615; Tue, 26 Mar 2013 11:48:34 -0400 From: Cornelia Huck To: qemu-devel Date: Tue, 26 Mar 2013 18:09:06 +0100 Message-Id: <1364317746-19166-2-git-send-email-cornelia.huck@de.ibm.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1364317746-19166-1-git-send-email-cornelia.huck@de.ibm.com> References: <1364317746-19166-1-git-send-email-cornelia.huck@de.ibm.com> X-TM-AS-MML: No X-Content-Scanned: Fidelis XPS MAILER x-cbid: 13032617-0342-0000-0000-0000048FF61A X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic] X-Received-From: 195.75.94.111 Cc: Blue Swirl , Anthony Liguori , Alexander Graf , =?UTF-8?q?Aur=C3=A9lien=20Jarno?= , qemu-stable@nongnu.org Subject: [Qemu-devel] [PATCH] virtio-ccw: Queue sanity check for notify hypercall. X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Verify that the virtio-ccw notify hypercall passed a reasonable value for queue. Cc: qemu-stable@nongnu.org Reported-by: Alexander Graf Signed-off-by: Cornelia Huck --- hw/s390x/s390-virtio-ccw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index d436414..76b63e2 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -31,6 +31,9 @@ static int virtio_ccw_hcall_notify(const uint64_t *args) if (!sch || !css_subch_visible(sch)) { return -EINVAL; } + if (queue >= VIRTIO_PCI_QUEUE_MAX) { + return -EINVAL; + } virtio_queue_notify(virtio_ccw_get_vdev(sch), queue); return 0;