From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47725) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZJsr5-0000yX-Qq for qemu-devel@nongnu.org; Mon, 27 Jul 2015 20:34:52 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZJsr4-0005ah-Un for qemu-devel@nongnu.org; Mon, 27 Jul 2015 20:34:51 -0400 Received: from mail-qk0-x236.google.com ([2607:f8b0:400d:c09::236]:35350) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZJsr4-0005ab-Qm for qemu-devel@nongnu.org; Mon, 27 Jul 2015 20:34:50 -0400 Received: by qkbm65 with SMTP id m65so45693961qkb.2 for ; Mon, 27 Jul 2015 17:34:50 -0700 (PDT) Sender: =?UTF-8?B?TWFyYy1BbmRyw6kgTHVyZWF1?= From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Tue, 28 Jul 2015 02:32:36 +0200 Message-Id: <1438043577-28636-25-git-send-email-marcandre.lureau@redhat.com> In-Reply-To: <1438043577-28636-1-git-send-email-marcandre.lureau@redhat.com> References: <1438043577-28636-1-git-send-email-marcandre.lureau@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH v2 24/45] ivshmem: check shm isn't already initialized List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , drjones@redhat.com, cam@cs.ualberta.ca, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , stefanha@redhat.com From: Marc-André Lureau The server should not be allowed to change the shm, this isn't handled by qemu (perhaps it could be though). Signed-off-by: Marc-André Lureau --- hw/misc/ivshmem.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index 9085f7c..b8167d9 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -534,6 +534,12 @@ static void ivshmem_read(void *opaque, const uint8_t *buf, int size) if (incoming_posn == -1) { void * map_ptr; + if (s->shm_fd >= 0) { + error_report("shm already initialized"); + close(incoming_fd); + return; + } + if (check_shm_size(s, incoming_fd, &err) == -1) { error_report_err(err); close(incoming_fd); -- 2.4.3