[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 4/7] virtio-serial: Don't copy over guest buffer to
From: |
Amit Shah |
Subject: |
[Qemu-devel] [PATCH 4/7] virtio-serial: Don't copy over guest buffer to host |
Date: |
Wed, 19 Jan 2011 17:57:16 +0530 |
When the guest writes something to a host, we copied over the entire
buffer first into the host and then processed it. Do away with that, it
could result in a malicious guest causing a DoS on the host.
Reported-by: Paul Brook <address@hidden>
Signed-off-by: Amit Shah <address@hidden>
---
hw/virtio-serial-bus.c | 15 ++++++++-------
1 files changed, 8 insertions(+), 7 deletions(-)
diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index e8c2a16..6726f72 100644
--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -132,16 +132,17 @@ static void do_flush_queued_data(VirtIOSerialPort *port,
VirtQueue *vq,
assert(virtio_queue_ready(vq));
while (!port->throttled && virtqueue_pop(vq, &elem)) {
- uint8_t *buf;
- size_t ret, buf_size;
+ unsigned int i;
- buf_size = iov_size(elem.out_sg, elem.out_num);
- buf = qemu_malloc(buf_size);
- ret = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, buf_size);
+ for (i = 0; i < elem.out_num; i++) {
+ size_t buf_size;
- port->info->have_data(port, buf, ret);
- qemu_free(buf);
+ buf_size = elem.out_sg[i].iov_len;
+ port->info->have_data(port,
+ elem.out_sg[i].iov_base,
+ buf_size);
+ }
virtqueue_push(vq, &elem, 0);
}
virtio_notify(vdev, vq);
--
1.7.3.4
- [Qemu-devel] [PATCH 0/7] virtio-serial: Don't copy guest buf to host, flow control, Amit Shah, 2011/01/19
- [Qemu-devel] [PATCH 1/7] virtio-console: Factor out common init between console and generic ports, Amit Shah, 2011/01/19
- [Qemu-devel] [PATCH 2/7] virtio-console: Remove unnecessary braces, Amit Shah, 2011/01/19
- [Qemu-devel] [PATCH 3/7] virtio-serial-bus: separate out discard logic in a separate function, Amit Shah, 2011/01/19
- [Qemu-devel] [PATCH 4/7] virtio-serial: Don't copy over guest buffer to host,
Amit Shah <=
- [Qemu-devel] [PATCH 7/7] virtio-serial: save/restore new fields in port struct, Amit Shah, 2011/01/19
- [Qemu-devel] [PATCH 6/7] virtio-serial: Add support for flow control, Amit Shah, 2011/01/19
- [Qemu-devel] [PATCH 5/7] virtio-serial: Let virtio-serial-bus know if all data was consumed, Amit Shah, 2011/01/19