| Message ID | 60d0ef242fa5d7e014a8c56f2bcc6d0cd7b6e56e.1291987020.git.amit.shah@redhat.com |
|---|---|
| State | New |
| Headers | show |
> - if (!discard) { > + if (discard) { > + goto next; > + } > + next: > virtqueue_push(vq, &elem, 0); Please don't do this. Paul
On (Fri) Dec 10 2010 [14:02:37], Paul Brook wrote: > > - if (!discard) { > > + if (discard) { > > + goto next; > > + } > > > + next: > > virtqueue_push(vq, &elem, 0); > > Please don't do this. Could you elaborate? I can move the 'discard' check into the following 'for' loop, but since the value of discard doesn't change, I moved it outside. Amit
diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c index ecf0056..3bbd915 100644 --- a/hw/virtio-serial-bus.c +++ b/hw/virtio-serial-bus.c @@ -125,17 +125,21 @@ static void do_flush_queued_data(VirtIOSerialPort *port, VirtQueue *vq, return; } while (virtqueue_pop(vq, &elem)) { - uint8_t *buf; - size_t ret, buf_size; + unsigned int i; - if (!discard) { - buf_size = iov_size(elem.out_sg, elem.out_num); - buf = qemu_malloc(buf_size); - ret = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, buf_size); + if (discard) { + goto next; + } + for (i = 0; i < elem.out_num; i++) { + size_t buf_size; - port->info->have_data(port, buf, ret); - qemu_free(buf); + buf_size = elem.out_sg[i].iov_len; + + port->info->have_data(port, + elem.out_sg[i].iov_base, + buf_size); } + next: virtqueue_push(vq, &elem, 0); } virtio_notify(vdev, vq);
When the guest writes something to a host, we copied over the entire buffer first into the host and then processed it. Do away with that, it could result in a malicious guest causing a DoS on the host. Reported-by: Paul Brook <paul@codesourcery.com> Signed-off-by: Amit Shah <amit.shah@redhat.com> --- hw/virtio-serial-bus.c | 20 ++++++++++++-------- 1 files changed, 12 insertions(+), 8 deletions(-)