From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=53492 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PfX8d-0000EO-4Q for qemu-devel@nongnu.org; Wed, 19 Jan 2011 07:27:48 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PfX8b-0007U8-Fk for qemu-devel@nongnu.org; Wed, 19 Jan 2011 07:27:47 -0500 Received: from mx1.redhat.com ([209.132.183.28]:46108) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PfX8b-0007U3-5Z for qemu-devel@nongnu.org; Wed, 19 Jan 2011 07:27:45 -0500 From: Amit Shah Date: Wed, 19 Jan 2011 17:57:16 +0530 Message-Id: <106196f3b85d5764226f2264d5fcfe9ef7fa3c3f.1295439749.git.amit.shah@redhat.com> In-Reply-To: References: In-Reply-To: References: Subject: [Qemu-devel] [PATCH 4/7] virtio-serial: Don't copy over guest buffer to host List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu list Cc: Amit Shah , Juan Quintela , Gerd Hoffmann , Paul Brook When the guest writes something to a host, we copied over the entire buffer first into the host and then processed it. Do away with that, it could result in a malicious guest causing a DoS on the host. Reported-by: Paul Brook Signed-off-by: Amit Shah --- hw/virtio-serial-bus.c | 15 ++++++++------- 1 files changed, 8 insertions(+), 7 deletions(-) diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c index e8c2a16..6726f72 100644 --- a/hw/virtio-serial-bus.c +++ b/hw/virtio-serial-bus.c @@ -132,16 +132,17 @@ static void do_flush_queued_data(VirtIOSerialPort *port, VirtQueue *vq, assert(virtio_queue_ready(vq)); while (!port->throttled && virtqueue_pop(vq, &elem)) { - uint8_t *buf; - size_t ret, buf_size; + unsigned int i; - buf_size = iov_size(elem.out_sg, elem.out_num); - buf = qemu_malloc(buf_size); - ret = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, buf_size); + for (i = 0; i < elem.out_num; i++) { + size_t buf_size; - port->info->have_data(port, buf, ret); - qemu_free(buf); + buf_size = elem.out_sg[i].iov_len; + port->info->have_data(port, + elem.out_sg[i].iov_base, + buf_size); + } virtqueue_push(vq, &elem, 0); } virtio_notify(vdev, vq); -- 1.7.3.4