Patchwork [4/5] virtio-serial: Don't copy over guest buffer to host

login
register
mail settings
Submitter Amit Shah
Date Dec. 10, 2010, 1:25 p.m.
Message ID <60d0ef242fa5d7e014a8c56f2bcc6d0cd7b6e56e.1291987020.git.amit.shah@redhat.com>
Download mbox | patch
Permalink /patch/75089/
State New
Headers show

Comments

Amit Shah - Dec. 10, 2010, 1:25 p.m.
When the guest writes something to a host, we copied over the entire
buffer first into the host and then processed it.  Do away with that, it
could result in a malicious guest causing a DoS on the host.

Reported-by: Paul Brook <paul@codesourcery.com>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
---
 hw/virtio-serial-bus.c |   20 ++++++++++++--------
 1 files changed, 12 insertions(+), 8 deletions(-)
Paul Brook - Dec. 10, 2010, 2:02 p.m.
> -        if (!discard) {
> +        if (discard) {
> +            goto next;
> +        }

> +    next:
>          virtqueue_push(vq, &elem, 0);

Please don't do this.

Paul
Amit Shah - Dec. 10, 2010, 2:59 p.m.
On (Fri) Dec 10 2010 [14:02:37], Paul Brook wrote:
> > -        if (!discard) {
> > +        if (discard) {
> > +            goto next;
> > +        }
> 
> > +    next:
> >          virtqueue_push(vq, &elem, 0);
> 
> Please don't do this.

Could you elaborate?

I can move the 'discard' check into the following 'for' loop, but since
the value of discard doesn't change, I moved it outside.

		Amit

Patch

diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index ecf0056..3bbd915 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -125,17 +125,21 @@  static void do_flush_queued_data(VirtIOSerialPort *port, VirtQueue *vq,
         return;
     }
     while (virtqueue_pop(vq, &elem)) {
-        uint8_t *buf;
-        size_t ret, buf_size;
+        unsigned int i;
 
-        if (!discard) {
-            buf_size = iov_size(elem.out_sg, elem.out_num);
-            buf = qemu_malloc(buf_size);
-            ret = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, buf_size);
+        if (discard) {
+            goto next;
+        }
+        for (i = 0; i < elem.out_num; i++) {
+            size_t buf_size;
 
-            port->info->have_data(port, buf, ret);
-            qemu_free(buf);
+            buf_size = elem.out_sg[i].iov_len;
+
+            port->info->have_data(port,
+                                  elem.out_sg[i].iov_base,
+                                  buf_size);
         }
+    next:
         virtqueue_push(vq, &elem, 0);
     }
     virtio_notify(vdev, vq);