From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael S. Tsirkin" Subject: Re: [PATCH 2/3] virtio: Strictly check queue_size when adding virtqueue Date: Wed, 15 Jun 2011 23:36:02 +0300 Message-ID: <20110615203602.GB8362@redhat.com> References: <20110615142524.26726.13785.stgit@localhost6.localdomain6> <20110615142533.26726.54603.stgit@localhost6.localdomain6> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: kvm@vger.kernel.org To: Amos Kong Return-path: Received: from mx1.redhat.com ([209.132.183.28]:16460 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752131Ab1FOUfr (ORCPT ); Wed, 15 Jun 2011 16:35:47 -0400 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p5FKZltL005185 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 15 Jun 2011 16:35:47 -0400 Content-Disposition: inline In-Reply-To: <20110615142533.26726.54603.stgit@localhost6.localdomain6> Sender: kvm-owner@vger.kernel.org List-ID: On Wed, Jun 15, 2011 at 10:25:33PM +0800, Amos Kong wrote: > Qemu should abort when 'queue_size' is less than or equals to zero. > > Signed-off-by: Amos Kong BTW, these patches apply upstream so should be sent to qemu-devel. > --- > hw/virtio.c | 3 ++- > 1 files changed, 2 insertions(+), 1 deletions(-) > > diff --git a/hw/virtio.c b/hw/virtio.c > index a3d0eee..855fe54 100644 > --- a/hw/virtio.c > +++ b/hw/virtio.c > @@ -612,7 +612,8 @@ VirtQueue *virtio_add_queue(VirtIODevice *vdev, int queue_size, > break; > } > > - if (i == VIRTIO_PCI_QUEUE_MAX || queue_size > VIRTQUEUE_MAX_SIZE) > + if (i == VIRTIO_PCI_QUEUE_MAX || queue_size > VIRTQUEUE_MAX_SIZE || > + queue_size <= 0) > abort(); > > vdev->vq[i].vring.num = queue_size; These checks are just a debugging aid - there's no way for the guest or user to trigger this. I guess it does no harm, but what are we guarding against? Why would anyone pass in a negative value? -- MST