qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
From: marcandre.lureau@redhat.com
To: qemu-devel@nongnu.org
Cc: peter.maydell@linaro.org, drjones@redhat.com,
	claudio.fontana@huawei.com, stefanha@redhat.com,
	"Marc-André Lureau" <marcandre.lureau@redhat.com>,
	pbonzini@redhat.com, cam@cs.ualberta.ca
Subject: [Qemu-devel] [PULL v3 04/51] ivhsmem: read do not accept more than sizeof(long)
Date: Tue, 13 Oct 2015 16:25:31 +0200	[thread overview]
Message-ID: <1444746378-12338-5-git-send-email-marcandre.lureau@redhat.com> (raw)
In-Reply-To: <1444746378-12338-1-git-send-email-marcandre.lureau@redhat.com>

From: Marc-André Lureau <marcandre.lureau@redhat.com>

ivshmem_read() only reads sizeof(long) from the input buffer.  Accepting
more could lead to fifo8 abort() on 32bit systems if fifo is not empty.

A following patch will change the protocol to 64-bit little-endian
instead.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
---
 hw/misc/ivshmem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index cc76989..fb53b3f 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -272,7 +272,7 @@ static void ivshmem_receive(void *opaque, const uint8_t *buf, int size)
 
 static int ivshmem_can_receive(void * opaque)
 {
-    return 8;
+    return sizeof(long);
 }
 
 static void ivshmem_event(void *opaque, int event)
-- 
2.4.3

  parent reply	other threads:[~2015-10-13 14:26 UTC|newest]

Thread overview: 60+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-10-13 14:25 [Qemu-devel] [PULL v3 00/51] Ivshmem patches marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 01/51] tests: Add ivshmem qtest marcandre.lureau
2015-10-13 17:07   ` Marc-André Lureau
2015-10-13 17:19     ` Andreas Färber
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 02/51] char: add qemu_chr_free() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 03/51] msix: add VMSTATE_MSIX_TEST marcandre.lureau
2015-10-13 14:25 ` marcandre.lureau [this message]
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 05/51] ivshmem: fix number of bytes to push to fifo marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 06/51] ivshmem: factor out the incoming fifo handling marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 07/51] ivshmem: remove unnecessary dup() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 08/51] ivshmem: remove superflous ivshmem_attr field marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 09/51] ivshmem: remove useless doorbell field marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 10/51] ivshmem: more qdev conversion marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 11/51] ivshmem: remove last exit(1) marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 12/51] ivshmem: limit maximum number of peers to G_MAXUINT16 marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 13/51] ivshmem: simplify around increase_dynamic_storage() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 14/51] ivshmem: allocate eventfds in resize_peers() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 15/51] ivshmem: remove useless ivshmem_update_irq() val argument marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 16/51] ivshmem: initialize max_peer to -1 marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 17/51] ivshmem: remove max_peer field marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 18/51] ivshmem: improve debug messages marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 19/51] ivshmem: improve error handling marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 20/51] ivshmem: print error on invalid peer id marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 21/51] ivshmem: simplify a bit the code marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 22/51] ivshmem: use common return marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 23/51] ivshmem: use common is_power_of_2() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 24/51] ivshmem: migrate with VMStateDescription marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 25/51] ivshmem: shmfd can be 0 marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 26/51] ivshmem: check shm isn't already initialized marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 27/51] ivshmem: add device description marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 28/51] ivshmem: fix pci_ivshmem_exit() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 29/51] ivshmem: replace 'guest' for 'peer' appropriately marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 30/51] ivshmem: error on too many eventfd received marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 31/51] ivshmem: reset mask on device reset marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 32/51] util: const event_notifier_get_fd() argument marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 33/51] contrib: add ivshmem client and server marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 34/51] ivshmem-client: check the number of vectors marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 35/51] ivshmem-server: use a uint16 for client ID marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 36/51] ivshmem-server: fix hugetlbfs support marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 37/51] docs: update ivshmem device spec marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 38/51] ivshmem: add check on protocol version in QEMU marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 39/51] contrib: remove unnecessary strdup() marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 40/51] msix: implement pba write (but read-only) marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 41/51] qtest: add qtest_add_abrt_handler() marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 42/51] glib-compat: add 2.38/2.40/2.46 asserts marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 43/51] tests: add ivshmem qtest marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 44/51] ivshmem: do not keep shm_fd open marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 45/51] ivshmem: use qemu_strtosz() marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 46/51] ivshmem: add hostmem backend marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 47/51] ivshmem: remove EventfdEntry.vector marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 48/51] ivshmem: rename MSI eventfd_table marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 49/51] ivshmem: use kvm irqfd for msi notifications marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 50/51] ivshmem: use little-endian int64_t for the protocol marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 51/51] doc: document ivshmem & hugepages marcandre.lureau
2015-10-13 15:58 ` [Qemu-devel] [PULL v3 00/51] Ivshmem patches Peter Maydell
2015-10-13 16:10   ` Marc-André Lureau
2015-10-13 16:12     ` Peter Maydell
2015-10-13 17:04     ` John Snow
2015-10-13 17:16       ` Marc-André Lureau
2015-10-13 17:51         ` John Snow

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1444746378-12338-5-git-send-email-marcandre.lureau@redhat.com \
    --to=marcandre.lureau@redhat.com \
    --cc=cam@cs.ualberta.ca \
    --cc=claudio.fontana@huawei.com \
    --cc=drjones@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=peter.maydell@linaro.org \
    --cc=qemu-devel@nongnu.org \
    --cc=stefanha@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).