[Qemu-devel] [PATCH] block/ssh: fix possible segmentation fault when .desc is not null-terminated

[Qemu-devel] [PATCH] block/ssh: fix possible segmentation fault when .desc is not null-terminated

[Murilo Opsfelder Araujo]

This patch prevents a possible segmentation fault when .desc members are checked
against NULL.

The ssh_runtime_opts was added by commit
8a6a80896d6af03b8ee0c17cdf37219eca2588a7 ("block/ssh: Use QemuOpts for runtime
options").

This fix was inspired by
http://lists.nongnu.org/archive/html/qemu-devel/2018-01/msg00883.html.

Fixes: 8a6a80896d6af03b8ee0c17cdf37219eca2588a7 ("block/ssh: Use QemuOpts for runtime options")
Cc: Max Reitz <mreitz@redhat.com>
Cc: Eric Blake <eblake@redhat.com>
Signed-off-by: Murilo Opsfelder Araujo <muriloo@linux.vnet.ibm.com>
---
 block/ssh.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/ssh.c b/block/ssh.c
index b049a16eb9..8890a0c4ba 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -556,6 +556,7 @@ static QemuOptsList ssh_runtime_opts = {
             .type = QEMU_OPT_STRING,
             .help = "Defines how and what to check the host key against",
         },
+        { /* end of list */ }
     },
 };
 
-- 
2.14.3

Re: [Qemu-devel] [PATCH] block/ssh: fix possible segmentation fault when .desc is not null-terminated

[Eric Blake]

[-- Attachment #1: Type: text/plain, Size: 1460 bytes --]

On 01/05/2018 08:44 AM, Murilo Opsfelder Araujo wrote:
> This patch prevents a possible segmentation fault when .desc members are checked
> against NULL.
> 
> The ssh_runtime_opts was added by commit
> 8a6a80896d6af03b8ee0c17cdf37219eca2588a7 ("block/ssh: Use QemuOpts for runtime
> options").
> 
> This fix was inspired by
> http://lists.nongnu.org/archive/html/qemu-devel/2018-01/msg00883.html.
> 
> Fixes: 8a6a80896d6af03b8ee0c17cdf37219eca2588a7 ("block/ssh: Use QemuOpts for runtime options")

present since 2.7.0, so we've gotten lucky that no one has actually
encountered a crash (but I didn't try hard to see if one was possible)

> Cc: Max Reitz <mreitz@redhat.com>
> Cc: Eric Blake <eblake@redhat.com>
> Signed-off-by: Murilo Opsfelder Araujo <muriloo@linux.vnet.ibm.com>
> ---
>  block/ssh.c | 1 +
>  1 file changed, 1 insertion(+)

CC: qemu-stable@nongnu.org
Reviewed-by: Eric Blake <eblake@redhat.com>

> 
> diff --git a/block/ssh.c b/block/ssh.c
> index b049a16eb9..8890a0c4ba 100644
> --- a/block/ssh.c
> +++ b/block/ssh.c
> @@ -556,6 +556,7 @@ static QemuOptsList ssh_runtime_opts = {
>              .type = QEMU_OPT_STRING,
>              .help = "Defines how and what to check the host key against",
>          },
> +        { /* end of list */ }
>      },
>  };
>  
> 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 619 bytes --]

Re: [Qemu-devel] [PATCH] block/ssh: fix possible segmentation fault when .desc is not null-terminated

[Murilo Opsfelder Araujo]

On 01/05/2018 02:57 PM, Eric Blake wrote:
> On 01/05/2018 08:44 AM, Murilo Opsfelder Araujo wrote:
>> This patch prevents a possible segmentation fault when .desc members are checked
>> against NULL.
>>
>> The ssh_runtime_opts was added by commit
>> 8a6a80896d6af03b8ee0c17cdf37219eca2588a7 ("block/ssh: Use QemuOpts for runtime
>> options").
>>
>> This fix was inspired by
>> http://lists.nongnu.org/archive/html/qemu-devel/2018-01/msg00883.html.
>>
>> Fixes: 8a6a80896d6af03b8ee0c17cdf37219eca2588a7 ("block/ssh: Use QemuOpts for runtime options")
> 
> present since 2.7.0, so we've gotten lucky that no one has actually
> encountered a crash (but I didn't try hard to see if one was possible)
> 
>> Cc: Max Reitz <mreitz@redhat.com>
>> Cc: Eric Blake <eblake@redhat.com>
>> Signed-off-by: Murilo Opsfelder Araujo <muriloo@linux.vnet.ibm.com>
>> ---
>>  block/ssh.c | 1 +
>>  1 file changed, 1 insertion(+)
> 
> CC: qemu-stable@nongnu.org
> Reviewed-by: Eric Blake <eblake@redhat.com>

Hi, Eric.

Was this supposed to land stable-2.11 branch?

Cheers
Murilo

Re: [Qemu-devel] [PATCH] block/ssh: fix possible segmentation fault when .desc is not null-terminated

[Eric Blake]

On 02/15/2018 08:09 AM, Murilo Opsfelder Araujo wrote:
> On 01/05/2018 02:57 PM, Eric Blake wrote:
>> On 01/05/2018 08:44 AM, Murilo Opsfelder Araujo wrote:
>>> This patch prevents a possible segmentation fault when .desc members are checked
>>> against NULL.
>>>

>>> Cc: Max Reitz <mreitz@redhat.com>
>>> Cc: Eric Blake <eblake@redhat.com>
>>> Signed-off-by: Murilo Opsfelder Araujo <muriloo@linux.vnet.ibm.com>
>>> ---
>>>   block/ssh.c | 1 +
>>>   1 file changed, 1 insertion(+)
>>
>> CC: qemu-stable@nongnu.org
>> Reviewed-by: Eric Blake <eblake@redhat.com>
> 
> Hi, Eric.
> 
> Was this supposed to land stable-2.11 branch?

Oh well, it missed 2.11.1.  I don't think it's too much of a 
show-stopper.  If we have a 2.11.2, hopefully it gets in then; 
otherwise, waiting for 2.12 will be sufficient.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PATCH] block/ssh: fix possible segmentation fault when .desc is not null-terminated

[Jeff Cody]

On Fri, Jan 05, 2018 at 12:44:40PM -0200, Murilo Opsfelder Araujo wrote:
> This patch prevents a possible segmentation fault when .desc members are checked
> against NULL.
> 
> The ssh_runtime_opts was added by commit
> 8a6a80896d6af03b8ee0c17cdf37219eca2588a7 ("block/ssh: Use QemuOpts for runtime
> options").
> 
> This fix was inspired by
> http://lists.nongnu.org/archive/html/qemu-devel/2018-01/msg00883.html.
> 
> Fixes: 8a6a80896d6af03b8ee0c17cdf37219eca2588a7 ("block/ssh: Use QemuOpts for runtime options")
> Cc: Max Reitz <mreitz@redhat.com>
> Cc: Eric Blake <eblake@redhat.com>
> Signed-off-by: Murilo Opsfelder Araujo <muriloo@linux.vnet.ibm.com>
> ---
>  block/ssh.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/block/ssh.c b/block/ssh.c
> index b049a16eb9..8890a0c4ba 100644
> --- a/block/ssh.c
> +++ b/block/ssh.c
> @@ -556,6 +556,7 @@ static QemuOptsList ssh_runtime_opts = {
>              .type = QEMU_OPT_STRING,
>              .help = "Defines how and what to check the host key against",
>          },
> +        { /* end of list */ }
>      },
>  };
>  
> -- 
> 2.14.3
> 

Thanks,

Applied to my block branch:

git://github.com/codyprime/qemu-kvm-jtc block

-Jeff