From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:59412)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <stefanha@redhat.com>) id 1Zmksc-0005qO-1z
	for qemu-devel@nongnu.org; Thu, 15 Oct 2015 11:55:50 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <stefanha@redhat.com>) id 1ZmksY-0004nq-9l
	for qemu-devel@nongnu.org; Thu, 15 Oct 2015 11:55:45 -0400
Received: from mx1.redhat.com ([209.132.183.28]:53384)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <stefanha@redhat.com>) id 1ZmksX-0004na-MF
	for qemu-devel@nongnu.org; Thu, 15 Oct 2015 11:55:41 -0400
Date: Thu, 15 Oct 2015 17:01:43 +0200
From: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20151015150143.GC21733@stefanha-thinkpad.redhat.com>
References: <1444535584-18220-1-git-send-email-guangrong.xiao@linux.intel.com>
	<1444535584-18220-28-git-send-email-guangrong.xiao@linux.intel.com>
	<20151014094134.GC14874@stefanha-thinkpad>
	<561E6C1F.2000502@linux.intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <561E6C1F.2000502@linux.intel.com>
Subject: Re: [Qemu-devel] [PATCH v3 27/32] nvdimm: support
	DSM_CMD_IMPLEMENTED function
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Cc: ehabkost@redhat.com, kvm@vger.kernel.org, mst@redhat.com, gleb@kernel.org, Stefan Hajnoczi <stefanha@gmail.com>, mtosatti@redhat.com, qemu-devel@nongnu.org, pbonzini@redhat.com, imammedo@redhat.com, dan.j.williams@intel.com, rth@twiddle.net

On Wed, Oct 14, 2015 at 10:52:15PM +0800, Xiao Guangrong wrote:
> On 10/14/2015 05:41 PM, Stefan Hajnoczi wrote:
> >On Sun, Oct 11, 2015 at 11:52:59AM +0800, Xiao Guangrong wrote:
> >>+    out->len = sizeof(out->status);
> >
> >out->len is uint16_t, it needs cpu_to_le16().  There may be other
> >instances in this patch series.
> >
> 
> out->len is internally used only which is invisible to guest OS, i,e,
> we write this value and read this value by ourself. I think it is
> okay.

'out' points to guest memory.  Guest memory is untrusted so QEMU cannot
stash values there - an evil guest could modify them.

Please put the len variable on the QEMU stack or heap where the guest
cannot access it.