[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] virtio: check vring descriptor buffer length
From: |
Eric Blake |
Subject: |
Re: [Qemu-devel] [PATCH] virtio: check vring descriptor buffer length |
Date: |
Wed, 27 Jul 2016 10:13:04 -0600 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 |
On 07/27/2016 09:37 AM, P J P wrote:
> From: Prasad J Pandit <address@hidden>
>
> virtio back end uses set of buffers to facilitate I/O operations.
> An infinite loop unfolds in virtqueue_pop() if a buffer was
> of zero size. Add check to avoid it.
>
> Reported-by: Li Qiang <address@hidden>
> Signed-off-by: Prasad J Pandit <address@hidden>
> ---
> hw/virtio/virtio.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index 30ede3d..8de896c 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -457,6 +457,11 @@ static void virtqueue_map_desc(unsigned int *p_num_sg,
> hwaddr *addr, struct iove
> unsigned num_sg = *p_num_sg;
> assert(num_sg <= max_num_sg);
>
> + if (!sz) {
> + error_report("virtio: zero sized buffers are not allowed");
> + exit(1);
> + }
This lets the guest forcefully exit qemu. Isn't it better to just make
the guest error degrade the virtio device into a broken state (the guest
can no longer use it, but qemu doesn't exit)?
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature