From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:38642) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QWzYv-0005Jb-VW for qemu-devel@nongnu.org; Wed, 15 Jun 2011 19:31:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QWzYt-0005R7-In for qemu-devel@nongnu.org; Wed, 15 Jun 2011 19:31:53 -0400 Received: from mail-yw0-f45.google.com ([209.85.213.45]:33147) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QWzYt-0005Qt-5d for qemu-devel@nongnu.org; Wed, 15 Jun 2011 19:31:51 -0400 Received: by ywl41 with SMTP id 41so680314ywl.4 for ; Wed, 15 Jun 2011 16:31:50 -0700 (PDT) Message-ID: <4DF940E3.2020603@codemonkey.ws> Date: Wed, 15 Jun 2011 18:31:47 -0500 From: Anthony Liguori MIME-Version: 1.0 References: <20110615142524.26726.13785.stgit@localhost6.localdomain6> <20110615142533.26726.54603.stgit@localhost6.localdomain6> <20110615203602.GB8362@redhat.com> <20110615225359.GA2354@t400> In-Reply-To: <20110615225359.GA2354@t400> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 2/3] virtio: Strictly check queue_size when adding virtqueue List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Amos Kong Cc: qemu-devel@nongnu.org, kvm@vger.kernel.org, "Michael S. Tsirkin" On 06/15/2011 05:53 PM, Amos Kong wrote: > On Wed, Jun 15, 2011 at 11:36:02PM +0300, Michael S. Tsirkin wrote: >> On Wed, Jun 15, 2011 at 10:25:33PM +0800, Amos Kong wrote: >>> Qemu should abort when 'queue_size' is less than or equals to zero. >>> >>> Signed-off-by: Amos Kong >> >> BTW, these patches apply upstream so should be sent to qemu-devel. >> >>> --- >>> hw/virtio.c | 3 ++- >>> 1 files changed, 2 insertions(+), 1 deletions(-) >>> >>> diff --git a/hw/virtio.c b/hw/virtio.c >>> index a3d0eee..855fe54 100644 >>> --- a/hw/virtio.c >>> +++ b/hw/virtio.c >>> @@ -612,7 +612,8 @@ VirtQueue *virtio_add_queue(VirtIODevice *vdev, int queue_size, >>> break; >>> } >>> >>> - if (i == VIRTIO_PCI_QUEUE_MAX || queue_size> VIRTQUEUE_MAX_SIZE) >>> + if (i == VIRTIO_PCI_QUEUE_MAX || queue_size> VIRTQUEUE_MAX_SIZE || >>> + queue_size<= 0) >>> abort(); >>> >>> vdev->vq[i].vring.num = queue_size; >> >> These checks are just a debugging aid - there's no way >> for the guest or user to trigger this. >> I guess it does no harm, but what are we guarding against? >> Why would anyone pass in a negative value? > > It seems all exist usage of this function are all right, guest/user could not trigger this right now. > So we don't need to fix this kind of problem? If it's not valid for queue_size to be negative, then the type ought to be unsigned. Regards, Anthony Liguori >