From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=46192 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PR4RS-0000uD-4s for qemu-devel@nongnu.org; Fri, 10 Dec 2010 09:59:26 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PR4RQ-0003DM-I6 for qemu-devel@nongnu.org; Fri, 10 Dec 2010 09:59:26 -0500 Received: from mx1.redhat.com ([209.132.183.28]:1851) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PR4RQ-0003Cz-7a for qemu-devel@nongnu.org; Fri, 10 Dec 2010 09:59:24 -0500 Date: Fri, 10 Dec 2010 20:29:07 +0530 From: Amit Shah Message-ID: <20101210145906.GC15015@amit-x200.redhat.com> References: <38a2b7e584b2d76a6b8d116e9e291edb3b0ef50d.1291987020.git.amit.shah@redhat.com> <201012101359.50252.paul@codesourcery.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <201012101359.50252.paul@codesourcery.com> Subject: [Qemu-devel] Re: [PATCH 5/5] virtio-serial: Error out if guest sends unexpected vq elements List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paul Brook Cc: qemu list On (Fri) Dec 10 2010 [13:59:50], Paul Brook wrote: > > Check if the guest really sent any items in the out_vq before using > > them. Similarly, check if there is a buffer to send data in before > > writing. > > Can this actually happen? If so why/how? > Why does it need a special case in this device? A malicious guest (ie, a guest with the virtio_console module suitably modified) could send in buffers with the 'input' bit set instead of output as expected or vice-versa. > If this is guest triggerable then calling abort() is wrong. It's either a guest bug or a malicious guest. What action is recommended? Amit