[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 13/33] virtio-9p: handle handle_9p_output() error
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL 13/33] virtio-9p: handle handle_9p_output() error |
Date: |
Mon, 10 Oct 2016 05:57:52 +0300 |
From: Greg Kurz <address@hidden>
A broken guest may send a request without providing buffers for the reply
or for the request itself, and virtqueue_pop() will return an element with
either in_num == 0 or out_num == 0.
All 9P requests are expected to start with the following 7-byte header:
uint32_t size_le;
uint8_t id;
uint16_t tag_le;
If iov_to_buf() fails to return these 7 bytes, then something is wrong in
the guest.
In both cases, it is wrong to crash QEMU, since the root cause lies in the
guest.
This patch hence does the following:
- keep the check of in_num since pdu_complete() assumes it has enough
space to store the reply and we will send something broken to the guest
- let iov_to_buf() handle out_num == 0, since it will return 0 just like
if the guest had provided an zero-sized buffer.
- call virtio_error() to inform the guest that the device is now broken,
instead of aborting
- detach the request from the virtqueue and free it
Signed-off-by: Greg Kurz <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
---
hw/9pfs/virtio-9p-device.c | 26 +++++++++++++++++++++-----
1 file changed, 21 insertions(+), 5 deletions(-)
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index e7ea0e4..a338f64 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -41,6 +41,7 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue
*vq)
V9fsState *s = &v->state;
V9fsPDU *pdu;
ssize_t len;
+ VirtQueueElement *elem;
while ((pdu = pdu_alloc(s))) {
struct {
@@ -48,21 +49,28 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue
*vq)
uint8_t id;
uint16_t tag_le;
} QEMU_PACKED out;
- VirtQueueElement *elem;
elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
if (!elem) {
- pdu_free(pdu);
- break;
+ goto out_free_pdu;
}
- BUG_ON(elem->out_num == 0 || elem->in_num == 0);
+ if (elem->in_num == 0) {
+ virtio_error(vdev,
+ "The guest sent a VirtFS request without space for "
+ "the reply");
+ goto out_free_req;
+ }
QEMU_BUILD_BUG_ON(sizeof(out) != 7);
v->elems[pdu->idx] = elem;
len = iov_to_buf(elem->out_sg, elem->out_num, 0,
&out, sizeof(out));
- BUG_ON(len != sizeof(out));
+ if (len != sizeof(out)) {
+ virtio_error(vdev, "The guest sent a malformed VirtFS request: "
+ "header size is %zd, should be 7", len);
+ goto out_free_req;
+ }
pdu->size = le32_to_cpu(out.size_le);
@@ -72,6 +80,14 @@ static void handle_9p_output(VirtIODevice *vdev, VirtQueue
*vq)
qemu_co_queue_init(&pdu->complete);
pdu_submit(pdu);
}
+
+ return;
+
+out_free_req:
+ virtqueue_detach_element(vq, elem, 0);
+ g_free(elem);
+out_free_pdu:
+ pdu_free(pdu);
}
static uint64_t virtio_9p_get_features(VirtIODevice *vdev, uint64_t features,
--
MST
- [Qemu-devel] [PULL 01/33] virtio-balloon: Remove needless precompiled directive, (continued)
- [Qemu-devel] [PULL 01/33] virtio-balloon: Remove needless precompiled directive, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 03/33] virtio-serial: enable virtio console emergency write feature, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 06/33] tests: acpi: extend cphp testcase with numa check, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 08/33] virtio: add virtio_detach_element(), Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 07/33] tests: acpi tables expected blobs update, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 05/33] acpi: provide _PXM method for CPU devices if QEMU is started numa enabled, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 09/33] virtio-blk: add missing virtio_detach_element() call, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 04/33] numa: reduce code duplication by adding helper numa_get_node_for_cpu(), Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 17/33] virtio-net: handle virtio_net_flush_tx() errors, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 19/33] virtio-scsi: handle virtio_scsi_set_config() error, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 13/33] virtio-9p: handle handle_9p_output() error,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL 18/33] virtio-scsi: convert virtio_scsi_bad_req() to use virtio_error(), Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 24/33] virtio-9p: convert VMSTATE_VIRTIO_DEVICE, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 27/33] virtio-input: convert VMSTATE_VIRTIO_DEVICE, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 16/33] virtio-net: handle virtio_net_receive() errors, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 10/33] virtio-serial: add missing virtio_detach_element() call, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 20/33] net: don't poke at chardev internal QemuOpts, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 23/33] virtio-net: convert VMSTATE_VIRTIO_DEVICE, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 15/33] virtio-net: handle virtio_net_handle_ctrl() error, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 29/33] virtio-balloon: convert VMSTATE_VIRTIO_DEVICE, Michael S. Tsirkin, 2016/10/09
- [Qemu-devel] [PULL 21/33] virtio: prepare change VMSTATE_VIRTIO_DEVICE macro, Michael S. Tsirkin, 2016/10/09