From patchwork Wed Sep 21 16:57:12 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kurz X-Patchwork-Id: 672983 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3sfQzM0b4mz9sD5 for ; Thu, 22 Sep 2016 03:07:27 +1000 (AEST) Received: from localhost ([::1]:45337 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmkzU-0005Bl-JN for incoming@patchwork.ozlabs.org; Wed, 21 Sep 2016 13:07:24 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39548) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmkpu-0005dy-32 for qemu-devel@nongnu.org; Wed, 21 Sep 2016 12:57:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bmkpq-0002wu-UQ for qemu-devel@nongnu.org; Wed, 21 Sep 2016 12:57:30 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:48444) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bmkpq-0002wc-L0 for qemu-devel@nongnu.org; Wed, 21 Sep 2016 12:57:26 -0400 Received: from pps.filterd (m0098396.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.17/8.16.0.17) with SMTP id u8LGrTh3144027 for ; Wed, 21 Sep 2016 12:57:25 -0400 Received: from e35.co.us.ibm.com (e35.co.us.ibm.com [32.97.110.153]) by mx0a-001b2d01.pphosted.com with ESMTP id 25kqvpbngb-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Wed, 21 Sep 2016 12:57:25 -0400 Received: from localhost by e35.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 21 Sep 2016 10:57:20 -0600 Received: from d03dlp03.boulder.ibm.com (9.17.202.179) by e35.co.us.ibm.com (192.168.1.135) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 21 Sep 2016 10:57:16 -0600 Received: from b03cxnp07028.gho.boulder.ibm.com (b03cxnp07028.gho.boulder.ibm.com [9.17.130.15]) by d03dlp03.boulder.ibm.com (Postfix) with ESMTP id 9D30D19D8047; Wed, 21 Sep 2016 10:56:44 -0600 (MDT) Received: from b03ledav005.gho.boulder.ibm.com (b03ledav005.gho.boulder.ibm.com [9.17.130.236]) by b03cxnp07028.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u8LGvFug14025016; Wed, 21 Sep 2016 09:57:15 -0700 Received: from b03ledav005.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9892BBE039; Wed, 21 Sep 2016 10:57:15 -0600 (MDT) Received: from [192.168.66.108] (unknown [9.83.153.110]) by b03ledav005.gho.boulder.ibm.com (Postfix) with ESMTP id 93500BE03A; Wed, 21 Sep 2016 10:57:13 -0600 (MDT) From: Greg Kurz To: qemu-devel@nongnu.org Date: Wed, 21 Sep 2016 18:57:12 +0200 In-Reply-To: <147447700612.30952.9420141963781948805.stgit@bahia> References: <147447700612.30952.9420141963781948805.stgit@bahia> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16092116-0012-0000-0000-000010B5EFA7 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00005797; HX=3.00000240; KW=3.00000007; PH=3.00000004; SC=3.00000185; SDB=6.00759917; UDB=6.00361360; IPR=6.00534336; BA=6.00004744; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00012740; XFM=3.00000011; UTC=2016-09-21 16:57:19 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16092116-0013-0000-0000-000045AB7576 Message-Id: <147447703245.30952.11628276217402153393.stgit@bahia> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-09-21_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=3 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1609020000 definitions=main-1609210307 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PATCH v2 3/9] virtio-9p: handle handle_9p_output() error X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , "Michael S. Tsirkin" , Jason Wang , Greg Kurz , Max Reitz , "Aneesh Kumar K.V" , Stefan Hajnoczi , Cornelia Huck , Paolo Bonzini Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" A broken guest may send a request with only non-empty out buffers or only non-empty in buffers, virtqueue_pop() will then return a VirtQueueElement with out_num == 0 or in_num == 0 respectively. All 9P requests are expected to start with the following 7-byte header: uint32_t size_le; uint8_t id; uint16_t tag_le; If iov_to_buf() fails to return these 7 bytes, then something is wrong in the guest. In both cases, it is wrong to crash QEMU, since the root cause lies in the guest. Let's switch the device to the broken state instead. Signed-off-by: Greg Kurz Reviewed-by: Cornelia Huck Reviewed-by: Stefan Hajnoczi --- v2: - added out_free_pdu: label for errors or when virtqueue is empty --- hw/9pfs/virtio-9p-device.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c index e7ea0e45f3dd..5f3a67cfc717 100644 --- a/hw/9pfs/virtio-9p-device.c +++ b/hw/9pfs/virtio-9p-device.c @@ -52,17 +52,24 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq) elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); if (!elem) { - pdu_free(pdu); - break; + goto out_free_pdu; } - BUG_ON(elem->out_num == 0 || elem->in_num == 0); + if (elem->out_num == 0 || elem->in_num == 0) { + virtio_error(vdev, + "The guest sent a VirtFS request without headers"); + goto out_free_pdu; + } QEMU_BUILD_BUG_ON(sizeof(out) != 7); v->elems[pdu->idx] = elem; len = iov_to_buf(elem->out_sg, elem->out_num, 0, &out, sizeof(out)); - BUG_ON(len != sizeof(out)); + if (len != sizeof(out)) { + virtio_error(vdev, "The guest sent a malformed VirtFS request: " + "header size is %zd, should be 7", len); + goto out_free_pdu; + } pdu->size = le32_to_cpu(out.size_le); @@ -72,6 +79,11 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq) qemu_co_queue_init(&pdu->complete); pdu_submit(pdu); } + + return; + +out_free_pdu: + pdu_free(pdu); } static uint64_t virtio_9p_get_features(VirtIODevice *vdev, uint64_t features,