From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60579) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9H06-0004Lg-AD for qemu-devel@nongnu.org; Thu, 08 Jan 2015 12:36:29 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y9Gzo-0006mb-NR for qemu-devel@nongnu.org; Thu, 08 Jan 2015 12:36:02 -0500 Received: from e33.co.us.ibm.com ([32.97.110.151]:37859) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y9Gzo-0006lZ-GA for qemu-devel@nongnu.org; Thu, 08 Jan 2015 12:35:44 -0500 Received: from /spool/local by e33.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 8 Jan 2015 10:35:43 -0700 From: Michael Roth Date: Thu, 8 Jan 2015 11:33:25 -0600 Message-Id: <1420738472-23267-22-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1420738472-23267-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1420738472-23267-1-git-send-email-mdroth@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH 21/88] ivshmem: Check ivshmem_read() size argument List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-stable@nongnu.org From: Stefan Hajnoczi The third argument to the fd_read() callback implemented by ivshmem_read() is the number of bytes, not a flags field. Fix this and check we received enough bytes before accessing the buffer pointer. Cc: Cam Macdonell Reported-by: Sebastian Krahmer Signed-off-by: Stefan Hajnoczi [AF: Handle partial reads via FIFO] Reported-by: Peter Maydell Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber Reviewed-by: Michael S. Tsirkin Signed-off-by: Paolo Bonzini (cherry picked from commit a2e9011b4164894594bf0b2a2a59e9c55c58c17b) Signed-off-by: Michael Roth --- hw/misc/ivshmem.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index 768e528..2a05961 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -24,6 +24,7 @@ #include "migration/migration.h" #include "qapi/qmp/qerror.h" #include "qemu/event_notifier.h" +#include "qemu/fifo8.h" #include "sysemu/char.h" #include @@ -73,6 +74,7 @@ typedef struct IVShmemState { CharDriverState **eventfd_chr; CharDriverState *server_chr; + Fifo8 incoming_fifo; MemoryRegion ivshmem_mmio; /* We might need to register the BAR before we actually have the memory. @@ -420,14 +422,35 @@ static void increase_dynamic_storage(IVShmemState *s, int new_min_size) { } } -static void ivshmem_read(void *opaque, const uint8_t * buf, int flags) +static void ivshmem_read(void *opaque, const uint8_t *buf, int size) { IVShmemState *s = opaque; int incoming_fd, tmp_fd; int guest_max_eventfd; long incoming_posn; - memcpy(&incoming_posn, buf, sizeof(long)); + if (fifo8_is_empty(&s->incoming_fifo) && size == sizeof(incoming_posn)) { + memcpy(&incoming_posn, buf, size); + } else { + const uint8_t *p; + uint32_t num; + + IVSHMEM_DPRINTF("short read of %d bytes\n", size); + num = MAX(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo)); + fifo8_push_all(&s->incoming_fifo, buf, num); + if (fifo8_num_used(&s->incoming_fifo) < sizeof(incoming_posn)) { + return; + } + size -= num; + buf += num; + p = fifo8_pop_buf(&s->incoming_fifo, sizeof(incoming_posn), &num); + g_assert(num == sizeof(incoming_posn)); + memcpy(&incoming_posn, p, sizeof(incoming_posn)); + if (size > 0) { + fifo8_push_all(&s->incoming_fifo, buf, size); + } + } + /* pick off s->server_chr->msgfd and store it, posn should accompany msg */ tmp_fd = qemu_chr_fe_get_msgfd(s->server_chr); IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, tmp_fd); @@ -659,6 +682,8 @@ static int pci_ivshmem_init(PCIDevice *dev) s->ivshmem_size = ivshmem_get_size(s); } + fifo8_create(&s->incoming_fifo, sizeof(long)); + register_savevm(DEVICE(dev), "ivshmem", 0, 0, ivshmem_save, ivshmem_load, dev); @@ -795,6 +820,7 @@ static void pci_ivshmem_uninit(PCIDevice *dev) memory_region_destroy(&s->ivshmem); memory_region_destroy(&s->bar); unregister_savevm(DEVICE(dev), "ivshmem", s); + fifo8_destroy(&s->incoming_fifo); } static Property ivshmem_properties[] = { -- 1.9.1