From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57204) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V2Lzo-0005f8-PT for qemu-devel@nongnu.org; Thu, 25 Jul 2013 09:54:26 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1V2Lzj-0005iq-1g for qemu-devel@nongnu.org; Thu, 25 Jul 2013 09:54:20 -0400 Received: from 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.d.1.0.0.b.8.0.1.0.0.2.ip6.arpa ([2001:8b0:1d0::1]:58936 helo=mnementh.archaic.org.uk) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V2Lzi-0005hy-Q3 for qemu-devel@nongnu.org; Thu, 25 Jul 2013 09:54:14 -0400 From: Peter Maydell Date: Thu, 25 Jul 2013 14:37:42 +0100 Message-Id: <1374759463-6351-2-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1374759463-6351-1-git-send-email-peter.maydell@linaro.org> References: <1374759463-6351-1-git-send-email-peter.maydell@linaro.org> Subject: [Qemu-devel] [PATCH 1/2] hw/virtio/virtio: Don't allow guests to add/remove queues List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: KONRAD Frederic , Anthony Liguori , "Michael S. Tsirkin" , kvmarm@lists.cs.columbia.edu, patches@linaro.org A queue size of 0 is used to indicate a nonexistent queue, so don't allow the guest to flip a queue between zero-size and non-zero-size. Don't permit setting of negative queue sizes either. Signed-off-by: Peter Maydell --- hw/virtio/virtio.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 09f62c6..d5b0502 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -673,10 +673,14 @@ hwaddr virtio_queue_get_addr(VirtIODevice *vdev, int n) void virtio_queue_set_num(VirtIODevice *vdev, int n, int num) { - if (num <= VIRTQUEUE_MAX_SIZE) { - vdev->vq[n].vring.num = num; - virtqueue_init(&vdev->vq[n]); + if ((num == 0 && vdev->vq[n].vring.num != 0) || + (num != 0 && vdev->vq[n].vring.num == 0) || + (num > VIRTQUEUE_MAX_SIZE) || + (num < 0)) { + return; } + vdev->vq[n].vring.num = num; + virtqueue_init(&vdev->vq[n]); } int virtio_queue_get_num(VirtIODevice *vdev, int n) -- 1.7.9.5