* [Qemu-devel] [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load()
@ 2019-06-28 16:13 Li Qiang
2019-07-03 8:26 ` Marc-André Lureau
2019-08-26 15:58 ` Michael Tokarev
0 siblings, 2 replies; 3+ messages in thread
From: Li Qiang @ 2019-06-28 16:13 UTC (permalink / raw)
To: mst, kraxel; +Cc: Li Qiang, liq3ea, qemu-devel
While loading virtio-gpu, the data can be malicious, we
should check if the resource already exists.
Signed-off-by: Li Qiang <liq3ea@163.com>
---
hw/display/virtio-gpu.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 2b0f66b1d6..f1ebed9959 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
resource_id = qemu_get_be32(f);
while (resource_id != 0) {
+ res = virtio_gpu_find_resource(g, resource_id);
+ if (res) {
+ return -EINVAL;
+ }
+
res = g_new0(struct virtio_gpu_simple_resource, 1);
res->resource_id = resource_id;
res->width = qemu_get_be32(f);
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load()
2019-06-28 16:13 [Qemu-devel] [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load() Li Qiang
@ 2019-07-03 8:26 ` Marc-André Lureau
2019-08-26 15:58 ` Michael Tokarev
1 sibling, 0 replies; 3+ messages in thread
From: Marc-André Lureau @ 2019-07-03 8:26 UTC (permalink / raw)
To: Li Qiang; +Cc: QEMU, Li Qiang, Gerd Hoffmann, Michael S. Tsirkin
On Fri, Jun 28, 2019 at 8:53 PM Li Qiang <liq3ea@163.com> wrote:
>
> While loading virtio-gpu, the data can be malicious, we
> should check if the resource already exists.
>
> Signed-off-by: Li Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
> hw/display/virtio-gpu.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
> index 2b0f66b1d6..f1ebed9959 100644
> --- a/hw/display/virtio-gpu.c
> +++ b/hw/display/virtio-gpu.c
> @@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
>
> resource_id = qemu_get_be32(f);
> while (resource_id != 0) {
> + res = virtio_gpu_find_resource(g, resource_id);
> + if (res) {
> + return -EINVAL;
> + }
> +
> res = g_new0(struct virtio_gpu_simple_resource, 1);
> res->resource_id = resource_id;
> res->width = qemu_get_be32(f);
> --
> 2.17.1
>
>
>
--
Marc-André Lureau
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load()
2019-06-28 16:13 [Qemu-devel] [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load() Li Qiang
2019-07-03 8:26 ` Marc-André Lureau
@ 2019-08-26 15:58 ` Michael Tokarev
1 sibling, 0 replies; 3+ messages in thread
From: Michael Tokarev @ 2019-08-26 15:58 UTC (permalink / raw)
To: Li Qiang, mst, kraxel; +Cc: liq3ea, qemu-devel
28.06.2019 19:13, Li Qiang wrote:
> While loading virtio-gpu, the data can be malicious, we
> should check if the resource already exists.
>
> Signed-off-by: Li Qiang <liq3ea@163.com>
> ---
> hw/display/virtio-gpu.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
> index 2b0f66b1d6..f1ebed9959 100644
> --- a/hw/display/virtio-gpu.c
> +++ b/hw/display/virtio-gpu.c
> @@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
>
> resource_id = qemu_get_be32(f);
> while (resource_id != 0) {
> + res = virtio_gpu_find_resource(g, resource_id);
> + if (res) {
> + return -EINVAL;
EEXIST?
/mjt
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-08-26 16:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-06-28 16:13 [Qemu-devel] [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load() Li Qiang
2019-07-03 8:26 ` Marc-André Lureau
2019-08-26 15:58 ` Michael Tokarev
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).