From: "Michael S. Tsirkin" <mst@redhat.com>
To: qemu-devel@nongnu.org
Cc: Peter Maydell <peter.maydell@linaro.org>,
zhenwei pi <pizhenwei@bytedance.com>,
Gonglei <arei.gonglei@huawei.com>,
Mauro Matteo Cascella <mcascell@redhat.com>,
Xiao Lei <nop.leixiao@gmail.com>,
Yongkang Jia <kangel@zju.edu.cn>, Yiming Tao <taoym@zju.edu.cn>
Subject: [PULL 22/22] cryptodev: Handle unexpected request to avoid crash
Date: Thu, 3 Aug 2023 18:21:57 -0400 [thread overview]
Message-ID: <15b11a1da6a4b7c6b8bb37883f52b544dee2b8fd.1691101215.git.mst@redhat.com> (raw)
In-Reply-To: <cover.1691101215.git.mst@redhat.com>
From: zhenwei pi <pizhenwei@bytedance.com>
Generally guest side should discover which services the device is
able to offer, then do requests on device.
However it's also possible to break this rule in a guest. Handle
unexpected request here to avoid NULL pointer dereference.
Fixes: e7a775fd ('cryptodev: Account statistics')
Cc: Gonglei <arei.gonglei@huawei.com>
Cc: Mauro Matteo Cascella <mcascell@redhat.com>
Cc: Xiao Lei <nop.leixiao@gmail.com>
Cc: Yongkang Jia <kangel@zju.edu.cn>
Reported-by: Yiming Tao <taoym@zju.edu.cn>
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-Id: <20230803024314.29962-3-pizhenwei@bytedance.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
backends/cryptodev.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/backends/cryptodev.c b/backends/cryptodev.c
index 7d29517843..4d183f7237 100644
--- a/backends/cryptodev.c
+++ b/backends/cryptodev.c
@@ -191,6 +191,11 @@ static int cryptodev_backend_account(CryptoDevBackend *backend,
if (algtype == QCRYPTODEV_BACKEND_ALG_ASYM) {
CryptoDevBackendAsymOpInfo *asym_op_info = op_info->u.asym_op_info;
len = asym_op_info->src_len;
+
+ if (unlikely(!backend->asym_stat)) {
+ error_report("cryptodev: Unexpected asym operation");
+ return -VIRTIO_CRYPTO_NOTSUPP;
+ }
switch (op_info->op_code) {
case VIRTIO_CRYPTO_AKCIPHER_ENCRYPT:
CryptodevAsymStatIncEncrypt(backend, len);
@@ -210,6 +215,11 @@ static int cryptodev_backend_account(CryptoDevBackend *backend,
} else if (algtype == QCRYPTODEV_BACKEND_ALG_SYM) {
CryptoDevBackendSymOpInfo *sym_op_info = op_info->u.sym_op_info;
len = sym_op_info->src_len;
+
+ if (unlikely(!backend->sym_stat)) {
+ error_report("cryptodev: Unexpected sym operation");
+ return -VIRTIO_CRYPTO_NOTSUPP;
+ }
switch (op_info->op_code) {
case VIRTIO_CRYPTO_CIPHER_ENCRYPT:
CryptodevSymStatIncEncrypt(backend, len);
--
MST
next prev parent reply other threads:[~2023-08-03 22:22 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-03 22:20 [PULL 00/22] pc,pci,virtio,crypto: bugfixes Michael S. Tsirkin
2023-08-03 22:20 ` [PULL 01/22] hw/virtio-iommu: Fix potential OOB access in virtio_iommu_handle_command() Michael S. Tsirkin
2023-08-03 22:20 ` [PULL 02/22] hw/pci-bridge/cxl_upstream.c: Use g_new0() in build_cdat_table() Michael S. Tsirkin
2023-08-03 22:20 ` [PULL 03/22] virtio-iommu: Standardize granule extraction and formatting Michael S. Tsirkin
2023-08-03 22:20 ` [PULL 04/22] hw/virtio: Add a protection against duplicate vu_scmi_stop calls Michael S. Tsirkin
2023-08-03 22:20 ` [PULL 05/22] tests: acpi: x86: whitelist expected blobs Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 06/22] x86: acpi: workaround Windows not handling name references in Package properly Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 07/22] tests: acpi: x86: update expected blobs Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 08/22] tests: acpi: whitelist " Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 09/22] acpi: x86: remove _ADR on host bridges Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 10/22] tests: acpi: update expected blobs Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 11/22] hw/virtio: qmp: add RING_RESET to 'info virtio-status' Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 12/22] virtio: Fix packed virtqueue used_idx mask Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 13/22] pci: do not respond config requests after PCI device eject Michael S. Tsirkin
2023-08-04 4:37 ` Michael Tokarev
2023-08-03 22:21 ` [PULL 14/22] vhost: fix the fd leak Michael S. Tsirkin
2023-08-04 4:36 ` Michael Tokarev
2023-08-04 4:56 ` Michael Tokarev
2023-08-03 22:21 ` [PULL 15/22] hw/i386/intel_iommu: Fix trivial endianness problems Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 16/22] hw/i386/intel_iommu: Fix endianness problems related to VTD_IR_TableEntry Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 17/22] hw/i386/intel_iommu: Fix struct VTDInvDescIEC on big endian hosts Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 18/22] hw/i386/intel_iommu: Fix index calculation in vtd_interrupt_remap_msi() Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 19/22] hw/i386/x86-iommu: Fix endianness issue in x86_iommu_irq_to_msi_message() Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 20/22] include/hw/i386/x86-iommu: Fix struct X86IOMMU_MSIMessage for big endian hosts Michael S. Tsirkin
2023-08-03 22:21 ` [PULL 21/22] virtio-crypto: verify src&dst buffer length for sym request Michael S. Tsirkin
2023-08-03 22:21 ` Michael S. Tsirkin [this message]
2023-08-04 4:35 ` [PULL 22/22] cryptodev: Handle unexpected request to avoid crash Michael Tokarev
2023-08-04 6:10 ` zhenwei pi
2023-08-04 6:35 ` Michael Tokarev
2023-08-04 4:12 ` [PULL 00/22] pc,pci,virtio,crypto: bugfixes Richard Henderson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=15b11a1da6a4b7c6b8bb37883f52b544dee2b8fd.1691101215.git.mst@redhat.com \
--to=mst@redhat.com \
--cc=arei.gonglei@huawei.com \
--cc=kangel@zju.edu.cn \
--cc=mcascell@redhat.com \
--cc=nop.leixiao@gmail.com \
--cc=peter.maydell@linaro.org \
--cc=pizhenwei@bytedance.com \
--cc=qemu-devel@nongnu.org \
--cc=taoym@zju.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).