From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:58533)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <david.marchand@6wind.com>) id 1WxHIf-00009D-PK
	for qemu-devel@nongnu.org; Wed, 18 Jun 2014 10:57:27 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <david.marchand@6wind.com>) id 1WxHIX-0005Nk-6O
	for qemu-devel@nongnu.org; Wed, 18 Jun 2014 10:57:21 -0400
Received: from mail-we0-f182.google.com ([74.125.82.182]:60120)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <david.marchand@6wind.com>) id 1WxHIX-0005NW-0I
	for qemu-devel@nongnu.org; Wed, 18 Jun 2014 10:57:13 -0400
Received: by mail-we0-f182.google.com with SMTP id q59so1011488wes.13
	for <qemu-devel@nongnu.org>; Wed, 18 Jun 2014 07:57:11 -0700 (PDT)
Message-ID: <53A1A8BE.3000801@6wind.com>
Date: Wed, 18 Jun 2014 16:57:02 +0200
From: David Marchand <david.marchand@6wind.com>
MIME-Version: 1.0
References: <87vbs6qjhj.fsf_-_@blackfin.pond.sub.org>
	<5399CF09.8030803@6wind.com> <87ppidnqmy.fsf@blackfin.pond.sub.org>
	<539AC3E0.9090404@6wind.com> <539ACDE6.7020709@redhat.com>
	<539AFF7C.7090702@6wind.com> <539B064D.2050501@redhat.com>
	<CAJSP0QUcFGSGgQMjU=Ax3n6Gqx6h_ZZ1yXz6QgQiyYYe+e4K4w@mail.gmail.com>
	<53A00464.8090609@6wind.com> <53A00DEB.8030400@redhat.com>
	<20140618104849.GH14030@stefanha-thinkpad.redhat.com>
In-Reply-To: <20140618104849.GH14030@stefanha-thinkpad.redhat.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] Why I advise against using ivshmem
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Hajnoczi <stefanha@gmail.com>, Paolo Bonzini <pbonzini@redhat.com>
Cc: Henning Schild <henning.schild@siemens.com>, Olivier MATZ <olivier.matz@6wind.com>, kvm <kvm@vger.kernel.org>, qemu-devel <qemu-devel@nongnu.org>, Linux Virtualization <virtualization@lists.linux-foundation.org>, Vincent JARDIN <vincent.jardin@6wind.com>, "thomas.monjalon@6wind.com" <thomas.monjalon@6wind.com>

Hello Stefan,

On 06/18/2014 12:48 PM, Stefan Hajnoczi wrote:
> One more thing to add to the list:
>
> static void ivshmem_read(void *opaque, const uint8_t * buf, int flags)
>
> The "flags" argument should be "size".  Size should be checked before
> accessing buf.

You are welcome to send a fix and I will review it.

>
> Please also see the bug fixes in the following unapplied patch:
> "[PATCH] ivshmem: fix potential OOB r/w access (#2)" by Sebastian Krahmer
> https://lists.gnu.org/archive/html/qemu-devel/2014-04/msg03538.html

Thanks for the pointer. I'll check it.



-- 
David Marchand