From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40479) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XF85S-0003wq-UM for qemu-devel@nongnu.org; Wed, 06 Aug 2014 16:45:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XF84z-0006Dl-F6 for qemu-devel@nongnu.org; Wed, 06 Aug 2014 16:45:30 -0400 Received: from e8.ny.us.ibm.com ([32.97.182.138]:45759) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XF84z-0006DX-Aq for qemu-devel@nongnu.org; Wed, 06 Aug 2014 16:45:01 -0400 Received: from /spool/local by e8.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 6 Aug 2014 16:45:01 -0400 From: Michael Roth Date: Wed, 6 Aug 2014 15:39:49 -0500 Message-Id: <1407357598-21541-100-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1407357598-21541-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1407357598-21541-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 099/108] Allow mismatched virtio config-len List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org From: "Dr. David Alan Gilbert" Commit 'virtio: validate config_len on load' restricted config_len loaded from the wire to match the config_len that the device had. Unfortunately, there are cases where this isn't true, the one we found it on was the wce addition in virtio-blk. Allow mismatched config-lengths: *) If the version on the wire is shorter then fine *) If the version on the wire is longer, load what we have space for and skip the rest. (This is mst@redhat.com's rework of what I originally posted) Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin (cherry picked from commit 2f5732e9648fcddc8759a8fd25c0b41a38352be6) Signed-off-by: Michael Roth --- hw/virtio/virtio.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 3557c17..3e4b70c 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -926,12 +926,18 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f) return -1; } config_len = qemu_get_be32(f); - if (config_len != vdev->config_len) { - error_report("Unexpected config length 0x%x. Expected 0x%zx", - config_len, vdev->config_len); - return -1; + + /* + * There are cases where the incoming config can be bigger or smaller + * than what we have; so load what we have space for, and skip + * any excess that's in the stream. + */ + qemu_get_buffer(f, vdev->config, MIN(config_len, vdev->config_len)); + + while (config_len > vdev->config_len) { + qemu_get_byte(f); + config_len--; } - qemu_get_buffer(f, vdev->config, vdev->config_len); num = qemu_get_be32(f); -- 1.9.1