[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 22/88] ivshmem: validate incoming_posn value from s
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 22/88] ivshmem: validate incoming_posn value from server |
Date: |
Thu, 8 Jan 2015 11:33:26 -0600 |
From: Stefan Hajnoczi <address@hidden>
Check incoming_posn to avoid out-of-bounds array accesses if the ivshmem
server on the host sends invalid values.
Cc: Cam Macdonell <address@hidden>
Reported-by: Sebastian Krahmer <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
[AF: Tighten upper bound check for posn in close_guest_eventfds()]
Cc: address@hidden
Signed-off-by: Andreas Färber <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit 363ba1c72fed4425e7917afc36722584aaeaad8a)
Signed-off-by: Michael Roth <address@hidden>
---
hw/misc/ivshmem.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 2a05961..02e3dd9 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -385,6 +385,9 @@ static void close_guest_eventfds(IVShmemState *s, int posn)
if (!ivshmem_has_feature(s, IVSHMEM_IOEVENTFD)) {
return;
}
+ if (posn < 0 || posn >= s->nb_peers) {
+ return;
+ }
guest_curr_max = s->peers[posn].nb_eventfds;
@@ -451,6 +454,11 @@ static void ivshmem_read(void *opaque, const uint8_t *buf,
int size)
}
}
+ if (incoming_posn < -1) {
+ IVSHMEM_DPRINTF("invalid incoming_posn %ld\n", incoming_posn);
+ return;
+ }
+
/* pick off s->server_chr->msgfd and store it, posn should accompany msg */
tmp_fd = qemu_chr_fe_get_msgfd(s->server_chr);
IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, tmp_fd);
--
1.9.1
- [Qemu-stable] [PATCH 02/88] qdev: Add cleanup logic in device_set_realized() to avoid resource leak, (continued)
- [Qemu-stable] [PATCH 02/88] qdev: Add cleanup logic in device_set_realized() to avoid resource leak, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 10/88] virtio-pci: enable bus master for old guests, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 13/88] gdbstub: init mon_chr through qemu_chr_alloc, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 15/88] qapi: dealloc visitor, implement visit_start_union, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 12/88] hw/arm/virt: fix pl011 and pl031 irq flags, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 16/88] tests: add QMP input visitor test for unions with no discriminator, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 14/88] qapi: add visit_start_union and visit_end_union, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 17/88] qemu-iotests: Test missing "driver" key for blockdev-add, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 20/88] vhost-user: fix VIRTIO_NET_F_MRG_RXBUF negotiation, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 18/88] monitor: Reset HMP mon->rs in CHR_EVENT_OPEN, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 22/88] ivshmem: validate incoming_posn value from server,
Michael Roth <=
- [Qemu-stable] [PATCH 25/88] pc-dimm: Don't check dimm->node when there is non-NUMA config, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 24/88] ivshmem: Fix fd leak on error, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 26/88] tests: avoid running duplicate qom-tests, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 28/88] smbios: Fix assertion on socket count calculation, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 27/88] snapshot: fix referencing wrong variable in while loop in do_delvm, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 33/88] virtio/vhost-scsi: fix virtio-scsi/vhost-scsi child refcount in transports, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 32/88] virtio/vhost-scsi: use aliases instead of duplicate qdev properties, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 38/88] virtio-balloon: fix virtio-balloon child refcount in transports, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 31/88] virtio-net: fix virtio-net child refcount in transports, Michael Roth, 2015/01/08
- [Qemu-stable] [PATCH 34/88] virtio-serial: use aliases instead of duplicate qdev properties, Michael Roth, 2015/01/08