ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

virtio: handle virtqueue_get_head() errors 

Stop processing the vring if virtqueue_get_head() fetches an
out-of-bounds head index.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
This commit is contained in:
Stefan Hajnoczi 2016-09-21 16:52:26 +01:00 committed by Michael S. Tsirkin
parent 4355c1abca
commit fb1131b674
1 changed files with 17 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
hw/virtio/virtio.c
View File

@ -360,21 +360,20 @@ static int virtqueue_num_heads(VirtQueue *vq, unsigned int idx)
return num_heads; return num_heads;
} }
static unsigned int virtqueue_get_head(VirtQueue *vq, unsigned int idx) static bool virtqueue_get_head(VirtQueue *vq, unsigned int idx,
unsigned int *head)
{ {
unsigned int head;
/* Grab the next descriptor number they're advertising, and increment /* Grab the next descriptor number they're advertising, and increment
* the index we've seen. */ * the index we've seen. */
head = vring_avail_ring(vq, idx % vq->vring.num); *head = vring_avail_ring(vq, idx % vq->vring.num);
/* If their number is silly, that's a fatal mistake. */ /* If their number is silly, that's a fatal mistake. */
if (head >= vq->vring.num) { if (*head >= vq->vring.num) {
error_report("Guest says index %u is available", head); virtio_error(vq->vdev, "Guest says index %u is available", *head);
exit(1); return false;
} }
return head; return true;
} }
enum { enum {
@ -426,7 +425,11 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
max = vq->vring.num; max = vq->vring.num;
num_bufs = total_bufs; num_bufs = total_bufs;
i = virtqueue_get_head(vq, idx++);
if (!virtqueue_get_head(vq, idx++, &i)) {
goto err;
}
desc_pa = vq->vring.desc; desc_pa = vq->vring.desc;
vring_desc_read(vdev, &desc, desc_pa, i); vring_desc_read(vdev, &desc, desc_pa, i);
@ -660,11 +663,15 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz)
return NULL; return NULL;
} }
i = head = virtqueue_get_head(vq, vq->last_avail_idx++); if (!virtqueue_get_head(vq, vq->last_avail_idx++, &head)) {
return NULL;
}
if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) { if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
vring_set_avail_event(vq, vq->last_avail_idx); vring_set_avail_event(vq, vq->last_avail_idx);
} }
i = head;
vring_desc_read(vdev, &desc, desc_pa, i); vring_desc_read(vdev, &desc, desc_pa, i);
if (desc.flags & VRING_DESC_F_INDIRECT) { if (desc.flags & VRING_DESC_F_INDIRECT) {
if (desc.len % sizeof(VRingDesc)) { if (desc.len % sizeof(VRingDesc)) {