[Qemu-devel] [PATCH v3 0/4] ivshmem security fixes

["Andreas Färber" <afaerber@suse.de>]

Hello,

This series tightens security on incoming data for ivshmem, originally sparked
by SUSE's security team (Sebastian Krahmer). I've combined them and tackled
remaining review feedback.

Regards,
Andreas

Changes from Sebastian's #2:
* Rebased onto Stefan's patches
* Dropped g_realloc() check (Stefan)
* Fixed fd leak and appended a patch fixing another one (Stefan)
* Simplified comment (Stefan)

Changes from Stefan's series:
* Modified to handle partial reads (Peter/Gerd)
* Changed check from > to >= (Peter)

Cc: Cam Macdonell <cam@cs.ualberta.ca>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Sebastian Krahmer <krahmer@suse.de>
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: David Marchand <david.marchand@6wind.com>

Andreas Färber (1):
  ivshmem: Fix fd leak on error

Sebastian Krahmer (1):
  ivshmem: Fix potential OOB r/w access

Stefan Hajnoczi (2):
  ivshmem: Check ivshmem_read() size argument
  ivshmem: validate incoming_posn value from server

 hw/misc/ivshmem.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 60 insertions(+), 6 deletions(-)

-- 
1.8.4.5