From: Stefan Hajnoczi <stefanha@redhat.com>
To: qemu-devel@nongnu.org
Cc: Laurent Vivier <lvivier@redhat.com>,
Kevin Wolf <kwolf@redhat.com>, Thomas Huth <thuth@redhat.com>,
qemu-block@nongnu.org, "Michael S. Tsirkin" <mst@redhat.com>,
Coiby Xu <coiby.xu@gmail.com>,
Raphael Norwitz <raphael.norwitz@nutanix.com>,
Stefan Hajnoczi <stefanha@redhat.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Max Reitz <mreitz@redhat.com>
Subject: [PATCH 04/12] block/export: fix vhost-user-blk get_config() information leak
Date: Tue, 27 Oct 2020 17:35:20 +0000 [thread overview]
Message-ID: <20201027173528.213464-5-stefanha@redhat.com> (raw)
In-Reply-To: <20201027173528.213464-1-stefanha@redhat.com>
Refuse get_config() requests in excess of sizeof(struct virtio_blk_config).
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
block/export/vhost-user-blk-server.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
index 33cc0818b8..62672d1cb9 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -266,6 +266,9 @@ vu_blk_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len)
{
VuServer *server = container_of(vu_dev, VuServer, vu_dev);
VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server);
+
+ g_return_val_if_fail(len <= sizeof(struct virtio_blk_config), -1);
+
memcpy(config, &vexp->blkcfg, len);
return 0;
}
--
2.26.2
next prev parent reply other threads:[~2020-10-27 17:41 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-27 17:35 [PATCH 00/12] block/export: vhost-user-blk server cleanups and tests Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 01/12] libvhost-user: follow QEMU comment style Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 02/12] configure: introduce --enable-vhost-user-blk-server Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 03/12] block/export: make vhost-user-blk config space little-endian Stefan Hajnoczi
2020-10-27 17:35 ` Stefan Hajnoczi [this message]
2020-10-27 17:35 ` [PATCH 05/12] contrib/vhost-user-blk: fix get_config() information leak Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 06/12] test: new qTest case to test the vhost-user-blk-server Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 07/12] tests/qtest: add multi-queue test case to vhost-user-blk-test Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 08/12] libqtest: add qtest_socket_server() Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 09/12] vhost-user-blk-test: rename destroy_drive() to destroy_file() Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 10/12] vhost-user-blk-test: close fork child file descriptors Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 11/12] vhost-user-blk-test: drop unused return value Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 12/12] vhost-user-blk-test: fix races by using fd passing Stefan Hajnoczi
2020-10-30 12:42 ` [PATCH 00/12] block/export: vhost-user-blk server cleanups and tests Michael S. Tsirkin
2020-11-02 10:43 ` Michael S. Tsirkin
2020-11-02 17:00 ` Stefan Hajnoczi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201027173528.213464-5-stefanha@redhat.com \
--to=stefanha@redhat.com \
--cc=coiby.xu@gmail.com \
--cc=kwolf@redhat.com \
--cc=lvivier@redhat.com \
--cc=mreitz@redhat.com \
--cc=mst@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=raphael.norwitz@nutanix.com \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).