From 1ee57de444ac7dd0cdb091fec318ba056ed173fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Tue, 23 Jun 2015 14:07:11 +0200 Subject: [PATCH] ivshmem: error on too many eventfd received MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The number of eventfd that can be handled per peer is limited by the number of vectors. Return an error when receiving too many of them. Signed-off-by: Marc-André Lureau Reviewed-by: Claudio Fontana --- hw/misc/ivshmem.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index 0e31d1d44c..d5207eecc1 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -571,6 +571,13 @@ static void ivshmem_read(void *opaque, const uint8_t *buf, int size) /* each peer has an associated array of eventfds, and we keep * track of how many eventfds received so far */ /* get a new eventfd: */ + if (peer->nb_eventfds >= s->vectors) { + error_report("Too many eventfd received, device has %d vectors", + s->vectors); + close(incoming_fd); + return; + } + new_eventfd = peer->nb_eventfds++; /* this is an eventfd for a particular peer VM */