From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38834) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZEcTS-0007l2-OT for qemu-devel@nongnu.org; Mon, 13 Jul 2015 08:04:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZEcTR-00060G-TH for qemu-devel@nongnu.org; Mon, 13 Jul 2015 08:04:42 -0400 Received: from mx1.redhat.com ([209.132.183.28]:38292) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZEcTR-0005zx-OP for qemu-devel@nongnu.org; Mon, 13 Jul 2015 08:04:41 -0400 Date: Mon, 13 Jul 2015 15:04:37 +0300 From: "Michael S. Tsirkin" Message-ID: <1436789051-18446-3-git-send-email-mst@redhat.com> References: <1436789051-18446-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1436789051-18446-1-git-send-email-mst@redhat.com> Subject: [Qemu-devel] [PULL 2/4] virtio-pci: don't crash on illegal length List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell Some guests seem to access cfg with an illegal length value. It's worth fixing them but debugging is easier if qemu does not crash. Signed-off-by: Michael S. Tsirkin --- hw/virtio/virtio-pci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c index 6ca0258..c5e8cc0 100644 --- a/hw/virtio/virtio-pci.c +++ b/hw/virtio/virtio-pci.c @@ -546,7 +546,8 @@ static void virtio_write_config(PCIDevice *pci_dev, uint32_t address, off = le32_to_cpu(cfg->cap.offset); len = le32_to_cpu(cfg->cap.length); - if (len <= sizeof cfg->pci_cfg_data) { + if (len == 1 || len == 2 || len == 4) { + assert(len <= sizeof cfg->pci_cfg_data); virtio_address_space_write(&proxy->modern_as, off, cfg->pci_cfg_data, len); } @@ -570,7 +571,8 @@ static uint32_t virtio_read_config(PCIDevice *pci_dev, off = le32_to_cpu(cfg->cap.offset); len = le32_to_cpu(cfg->cap.length); - if (len <= sizeof cfg->pci_cfg_data) { + if (len == 1 || len == 2 || len == 4) { + assert(len <= sizeof cfg->pci_cfg_data); virtio_address_space_read(&proxy->modern_as, off, cfg->pci_cfg_data, len); } -- MST