From patchwork Fri Dec 10 13:25:18 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Shah X-Patchwork-Id: 75091 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [199.232.76.165]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 1F2C9B70A4 for ; Sat, 11 Dec 2010 00:33:57 +1100 (EST) Received: from localhost ([127.0.0.1]:59045 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PR36g-0002zt-3U for incoming@patchwork.ozlabs.org; Fri, 10 Dec 2010 08:33:54 -0500 Received: from [140.186.70.92] (port=46589 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PR2z0-0005Hq-Vc for qemu-devel@nongnu.org; Fri, 10 Dec 2010 08:26:00 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PR2yy-0000lk-Er for qemu-devel@nongnu.org; Fri, 10 Dec 2010 08:25:58 -0500 Received: from mx1.redhat.com ([209.132.183.28]:13437) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PR2yy-0000lV-79 for qemu-devel@nongnu.org; Fri, 10 Dec 2010 08:25:56 -0500 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id oBADPk3n026806 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 10 Dec 2010 08:25:47 -0500 Received: from localhost (ovpn-113-77.phx2.redhat.com [10.3.113.77]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id oBADPiwq019414; Fri, 10 Dec 2010 08:25:45 -0500 From: Amit Shah To: qemu list Date: Fri, 10 Dec 2010 18:55:18 +0530 Message-Id: <38a2b7e584b2d76a6b8d116e9e291edb3b0ef50d.1291987020.git.amit.shah@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. Cc: Amit Shah , Paul Brook Subject: [Qemu-devel] [PATCH 5/5] virtio-serial: Error out if guest sends unexpected vq elements X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Check if the guest really sent any items in the out_vq before using them. Similarly, check if there is a buffer to send data in before writing. Signed-off-by: Amit Shah --- hw/virtio-serial-bus.c | 19 +++++++++++++++++++ 1 files changed, 19 insertions(+), 0 deletions(-) diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c index 3bbd915..3a3032f 100644 --- a/hw/virtio-serial-bus.c +++ b/hw/virtio-serial-bus.c @@ -102,6 +102,11 @@ static size_t write_to_port(VirtIOSerialPort *port, break; } + if (elem.in_num < 1) { + error_report("No buffer to send data in?"); + abort(); + } + len = iov_from_buf(elem.in_sg, elem.in_num, buf + offset, size - offset); offset += len; @@ -127,6 +132,11 @@ static void do_flush_queued_data(VirtIOSerialPort *port, VirtQueue *vq, while (virtqueue_pop(vq, &elem)) { unsigned int i; + if (elem.out_num < 1) { + error_report("No data sent by guest?"); + abort(); + } + if (discard) { goto next; } @@ -169,6 +179,11 @@ static size_t send_control_msg(VirtIOSerialPort *port, void *buf, size_t len) return 0; } + if (elem.in_num < 1) { + error_report("No buffer to send control data in?"); + abort(); + } + cpkt = (struct virtio_console_control *)buf; stl_p(&cpkt->id, port->id); memcpy(elem.in_sg[0].iov_base, buf, len); @@ -386,6 +401,10 @@ static void control_out(VirtIODevice *vdev, VirtQueue *vq) while (virtqueue_pop(vq, &elem)) { size_t cur_len, copied; + if (elem.out_num < 1) { + error_report("No data sent in control packet"); + abort(); + } cur_len = iov_size(elem.out_sg, elem.out_num); /* * Allocate a new buf only if we didn't have one previously or