From patchwork Fri Dec 10 13:25:17 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Shah X-Patchwork-Id: 75089 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 53AD3B70A4 for ; Sat, 11 Dec 2010 00:30:37 +1100 (EST) Received: from localhost ([127.0.0.1]:43735 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PR33S-0000bq-DM for incoming@patchwork.ozlabs.org; Fri, 10 Dec 2010 08:30:34 -0500 Received: from [140.186.70.92] (port=46546 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PR2yz-0005FA-1I for qemu-devel@nongnu.org; Fri, 10 Dec 2010 08:25:59 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PR2yv-0000kO-FK for qemu-devel@nongnu.org; Fri, 10 Dec 2010 08:25:56 -0500 Received: from mx1.redhat.com ([209.132.183.28]:56086) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PR2yv-0000k1-8O for qemu-devel@nongnu.org; Fri, 10 Dec 2010 08:25:53 -0500 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id oBADPgkf015283 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 10 Dec 2010 08:25:43 -0500 Received: from localhost (ovpn-113-77.phx2.redhat.com [10.3.113.77]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id oBADPeuI025804; Fri, 10 Dec 2010 08:25:41 -0500 From: Amit Shah To: qemu list Date: Fri, 10 Dec 2010 18:55:17 +0530 Message-Id: <60d0ef242fa5d7e014a8c56f2bcc6d0cd7b6e56e.1291987020.git.amit.shah@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. Cc: Amit Shah , Paul Brook Subject: [Qemu-devel] [PATCH 4/5] virtio-serial: Don't copy over guest buffer to host X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org When the guest writes something to a host, we copied over the entire buffer first into the host and then processed it. Do away with that, it could result in a malicious guest causing a DoS on the host. Reported-by: Paul Brook Signed-off-by: Amit Shah --- hw/virtio-serial-bus.c | 20 ++++++++++++-------- 1 files changed, 12 insertions(+), 8 deletions(-) diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c index ecf0056..3bbd915 100644 --- a/hw/virtio-serial-bus.c +++ b/hw/virtio-serial-bus.c @@ -125,17 +125,21 @@ static void do_flush_queued_data(VirtIOSerialPort *port, VirtQueue *vq, return; } while (virtqueue_pop(vq, &elem)) { - uint8_t *buf; - size_t ret, buf_size; + unsigned int i; - if (!discard) { - buf_size = iov_size(elem.out_sg, elem.out_num); - buf = qemu_malloc(buf_size); - ret = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, buf_size); + if (discard) { + goto next; + } + for (i = 0; i < elem.out_num; i++) { + size_t buf_size; - port->info->have_data(port, buf, ret); - qemu_free(buf); + buf_size = elem.out_sg[i].iov_len; + + port->info->have_data(port, + elem.out_sg[i].iov_base, + buf_size); } + next: virtqueue_push(vq, &elem, 0); } virtio_notify(vdev, vq);