From: marcandre.lureau@redhat.com
To: qemu-devel@nongnu.org
Cc: peter.maydell@linaro.org, drjones@redhat.com,
claudio.fontana@huawei.com, stefanha@redhat.com,
"Marc-André Lureau" <marcandre.lureau@redhat.com>,
pbonzini@redhat.com, cam@cs.ualberta.ca
Subject: [Qemu-devel] [PULL v3 04/51] ivhsmem: read do not accept more than sizeof(long)
Date: Tue, 13 Oct 2015 16:25:31 +0200 [thread overview]
Message-ID: <1444746378-12338-5-git-send-email-marcandre.lureau@redhat.com> (raw)
In-Reply-To: <1444746378-12338-1-git-send-email-marcandre.lureau@redhat.com>
From: Marc-André Lureau <marcandre.lureau@redhat.com>
ivshmem_read() only reads sizeof(long) from the input buffer. Accepting
more could lead to fifo8 abort() on 32bit systems if fifo is not empty.
A following patch will change the protocol to 64-bit little-endian
instead.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
---
hw/misc/ivshmem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index cc76989..fb53b3f 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -272,7 +272,7 @@ static void ivshmem_receive(void *opaque, const uint8_t *buf, int size)
static int ivshmem_can_receive(void * opaque)
{
- return 8;
+ return sizeof(long);
}
static void ivshmem_event(void *opaque, int event)
--
2.4.3
next prev parent reply other threads:[~2015-10-13 14:26 UTC|newest]
Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-13 14:25 [Qemu-devel] [PULL v3 00/51] Ivshmem patches marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 01/51] tests: Add ivshmem qtest marcandre.lureau
2015-10-13 17:07 ` Marc-André Lureau
2015-10-13 17:19 ` Andreas Färber
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 02/51] char: add qemu_chr_free() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 03/51] msix: add VMSTATE_MSIX_TEST marcandre.lureau
2015-10-13 14:25 ` marcandre.lureau [this message]
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 05/51] ivshmem: fix number of bytes to push to fifo marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 06/51] ivshmem: factor out the incoming fifo handling marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 07/51] ivshmem: remove unnecessary dup() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 08/51] ivshmem: remove superflous ivshmem_attr field marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 09/51] ivshmem: remove useless doorbell field marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 10/51] ivshmem: more qdev conversion marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 11/51] ivshmem: remove last exit(1) marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 12/51] ivshmem: limit maximum number of peers to G_MAXUINT16 marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 13/51] ivshmem: simplify around increase_dynamic_storage() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 14/51] ivshmem: allocate eventfds in resize_peers() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 15/51] ivshmem: remove useless ivshmem_update_irq() val argument marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 16/51] ivshmem: initialize max_peer to -1 marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 17/51] ivshmem: remove max_peer field marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 18/51] ivshmem: improve debug messages marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 19/51] ivshmem: improve error handling marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 20/51] ivshmem: print error on invalid peer id marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 21/51] ivshmem: simplify a bit the code marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 22/51] ivshmem: use common return marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 23/51] ivshmem: use common is_power_of_2() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 24/51] ivshmem: migrate with VMStateDescription marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 25/51] ivshmem: shmfd can be 0 marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 26/51] ivshmem: check shm isn't already initialized marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 27/51] ivshmem: add device description marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 28/51] ivshmem: fix pci_ivshmem_exit() marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 29/51] ivshmem: replace 'guest' for 'peer' appropriately marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 30/51] ivshmem: error on too many eventfd received marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 31/51] ivshmem: reset mask on device reset marcandre.lureau
2015-10-13 14:25 ` [Qemu-devel] [PULL v3 32/51] util: const event_notifier_get_fd() argument marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 33/51] contrib: add ivshmem client and server marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 34/51] ivshmem-client: check the number of vectors marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 35/51] ivshmem-server: use a uint16 for client ID marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 36/51] ivshmem-server: fix hugetlbfs support marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 37/51] docs: update ivshmem device spec marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 38/51] ivshmem: add check on protocol version in QEMU marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 39/51] contrib: remove unnecessary strdup() marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 40/51] msix: implement pba write (but read-only) marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 41/51] qtest: add qtest_add_abrt_handler() marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 42/51] glib-compat: add 2.38/2.40/2.46 asserts marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 43/51] tests: add ivshmem qtest marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 44/51] ivshmem: do not keep shm_fd open marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 45/51] ivshmem: use qemu_strtosz() marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 46/51] ivshmem: add hostmem backend marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 47/51] ivshmem: remove EventfdEntry.vector marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 48/51] ivshmem: rename MSI eventfd_table marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 49/51] ivshmem: use kvm irqfd for msi notifications marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 50/51] ivshmem: use little-endian int64_t for the protocol marcandre.lureau
2015-10-13 14:26 ` [Qemu-devel] [PULL v3 51/51] doc: document ivshmem & hugepages marcandre.lureau
2015-10-13 15:58 ` [Qemu-devel] [PULL v3 00/51] Ivshmem patches Peter Maydell
2015-10-13 16:10 ` Marc-André Lureau
2015-10-13 16:12 ` Peter Maydell
2015-10-13 17:04 ` John Snow
2015-10-13 17:16 ` Marc-André Lureau
2015-10-13 17:51 ` John Snow
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1444746378-12338-5-git-send-email-marcandre.lureau@redhat.com \
--to=marcandre.lureau@redhat.com \
--cc=cam@cs.ualberta.ca \
--cc=claudio.fontana@huawei.com \
--cc=drjones@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).