From e6194262a24b7f9295ac46903a310e09b3bb98cc Mon Sep 17 00:00:00 2001 From: Amit Shah Date: Tue, 27 Apr 2010 09:07:40 -0300 Subject: [PATCH 13/20] virtio-serial: Handle scatter-gather buffers for control messages RH-Author: Amit Shah Message-id: <1272359264-8464-14-git-send-email-amit.shah@redhat.com> Patchwork-id: 8859 O-Subject: [RHEL6 PATCH v4 13/17] virtio-serial: Handle scatter-gather buffers for control messages Bugzilla: 574296 RH-Acked-by: Gerd Hoffmann RH-Acked-by: Juan Quintela RH-Acked-by: Alon Levy Current control messages are small enough to not be split into multiple buffers but we could run into such a situation in the future or a malicious guest could cause such a situation. So handle the entire iov request for control messages. Also ensure the size of the control request is >= what we expect otherwise we risk accessing memory that we don't own. Bugzilla: 574296 Upstream: Signed-off-by: Amit Shah CC: Avi Kivity Reported-by: Avi Kivity --- hw/virtio-serial-bus.c | 31 ++++++++++++++++++++++++++++--- 1 files changed, 28 insertions(+), 3 deletions(-) Signed-off-by: Eduardo Habkost --- hw/virtio-serial-bus.c | 31 ++++++++++++++++++++++++++++--- 1 files changed, 28 insertions(+), 3 deletions(-) diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c index a72b6b5..b8410c3 100644 --- a/hw/virtio-serial-bus.c +++ b/hw/virtio-serial-bus.c @@ -204,7 +204,7 @@ size_t virtio_serial_guest_ready(VirtIOSerialPort *port) } /* Guest wants to notify us of some event */ -static void handle_control_message(VirtIOSerial *vser, void *buf) +static void handle_control_message(VirtIOSerial *vser, void *buf, size_t len) { struct VirtIOSerialPort *port; struct virtio_console_control cpkt, *gcpkt; @@ -213,6 +213,11 @@ static void handle_control_message(VirtIOSerial *vser, void *buf) gcpkt = buf; + if (len < sizeof(cpkt)) { + /* The guest sent an invalid control packet */ + return; + } + cpkt.event = lduw_p(&gcpkt->event); cpkt.value = lduw_p(&gcpkt->value); @@ -306,13 +311,33 @@ static void control_out(VirtIODevice *vdev, VirtQueue *vq) { VirtQueueElement elem; VirtIOSerial *vser; + uint8_t *buf; + size_t len; vser = DO_UPCAST(VirtIOSerial, vdev, vdev); + len = 0; + buf = NULL; while (virtqueue_pop(vq, &elem)) { - handle_control_message(vser, elem.out_sg[0].iov_base); - virtqueue_push(vq, &elem, elem.out_sg[0].iov_len); + size_t cur_len, copied; + + cur_len = iov_size(elem.out_sg, elem.out_num); + /* + * Allocate a new buf only if we didn't have one previously or + * if the size of the buf differs + */ + if (cur_len > len) { + qemu_free(buf); + + buf = qemu_malloc(cur_len); + len = cur_len; + } + copied = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, len); + + handle_control_message(vser, buf, copied); + virtqueue_push(vq, &elem, copied); } + qemu_free(buf); virtio_notify(vdev, vq); } -- 1.7.0.3