qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH] virtio: validate the existence of handle_output before calling it
@ 2015-02-12  3:05 Jason Wang
  2015-02-13 20:18 ` Don Koch
  2015-02-13 20:50 ` Paolo Bonzini
  0 siblings, 2 replies; 6+ messages in thread
From: Jason Wang @ 2015-02-12  3:05 UTC (permalink / raw)
  To: qemu-devel; +Cc: Jason Wang, qemu-stable, Anthony Liguori, Michael S. Tsirkin

We don't validate the existence of handle_output which may let a buggy
guest to trigger a SIGSEV easily. Fix this by validate its existence
before.

Cc: qemu-stable@nongnu.org
Cc: Anthony Liguori <aliguori@amazon.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/virtio.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index d735343..ffc22e8 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -761,6 +761,10 @@ void virtio_queue_notify_vq(VirtQueue *vq)
 {
     if (vq->vring.desc) {
         VirtIODevice *vdev = vq->vdev;
+
+        if (!vq->handle_output) {
+            return;
+        }
         trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
         vq->handle_output(vdev, vq);
     }
-- 
1.9.1

^ permalink raw reply related	[flat|nested] 6+ messages in thread

* Re: [Qemu-devel] [PATCH] virtio: validate the existence of handle_output before calling it
  2015-02-12  3:05 [Qemu-devel] [PATCH] virtio: validate the existence of handle_output before calling it Jason Wang
@ 2015-02-13 20:18 ` Don Koch
  2015-02-15  2:32   ` Jason Wang
  2015-02-13 20:50 ` Paolo Bonzini
  1 sibling, 1 reply; 6+ messages in thread
From: Don Koch @ 2015-02-13 20:18 UTC (permalink / raw)
  To: Jason Wang; +Cc: Michael S. Tsirkin, qemu-devel, Anthony Liguori, qemu-stable

On Thu, 12 Feb 2015 11:05:17 +0800
Jason Wang <jasowang@redhat.com> wrote:

> We don't validate the existence of handle_output which may let a buggy
> guest to trigger a SIGSEV easily. Fix this by validate its existence
> before.
> 
> Cc: qemu-stable@nongnu.org
> Cc: Anthony Liguori <aliguori@amazon.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
>  hw/virtio/virtio.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index d735343..ffc22e8 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -761,6 +761,10 @@ void virtio_queue_notify_vq(VirtQueue *vq)
>  {
>      if (vq->vring.desc) {
>          VirtIODevice *vdev = vq->vdev;
> +
> +        if (!vq->handle_output) {
> +            return;
> +        }

Maybe better to just change line 762 to:
     if (vq->vring.desc && vq->handle_output) {

-d

>          trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
>          vq->handle_output(vdev, vq);
>      }
> -- 
> 1.9.1
> 
> 

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [Qemu-devel] [PATCH] virtio: validate the existence of handle_output before calling it
  2015-02-12  3:05 [Qemu-devel] [PATCH] virtio: validate the existence of handle_output before calling it Jason Wang
  2015-02-13 20:18 ` Don Koch
@ 2015-02-13 20:50 ` Paolo Bonzini
  2015-02-15  2:35   ` Jason Wang
  1 sibling, 1 reply; 6+ messages in thread
From: Paolo Bonzini @ 2015-02-13 20:50 UTC (permalink / raw)
  To: Jason Wang, qemu-devel



On 12/02/2015 04:05, Jason Wang wrote:
> We don't validate the existence of handle_output which may let a buggy
> guest to trigger a SIGSEV easily. Fix this by validate its existence
> before.
> 
> Cc: qemu-stable@nongnu.org
> Cc: Anthony Liguori <aliguori@amazon.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>

Which queue was causing this?

Paolo

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [Qemu-devel] [PATCH] virtio: validate the existence of handle_output before calling it
  2015-02-13 20:18 ` Don Koch
@ 2015-02-15  2:32   ` Jason Wang
  0 siblings, 0 replies; 6+ messages in thread
From: Jason Wang @ 2015-02-15  2:32 UTC (permalink / raw)
  To: Don Koch; +Cc: Michael S. Tsirkin, qemu-devel, Anthony Liguori, qemu-stable



On Sat, Feb 14, 2015 at 4:18 AM, Don Koch <dkoch@verizon.com> wrote:
> On Thu, 12 Feb 2015 11:05:17 +0800
> Jason Wang <jasowang@redhat.com> wrote:
> 
>>  We don't validate the existence of handle_output which may let a 
>> buggy
>>  guest to trigger a SIGSEV easily. Fix this by validate its existence
>>  before.
>>  
>>  Cc: qemu-stable@nongnu.org
>>  Cc: Anthony Liguori <aliguori@amazon.com>
>>  Cc: Michael S. Tsirkin <mst@redhat.com>
>>  Signed-off-by: Jason Wang <jasowang@redhat.com>
>>  ---
>>   hw/virtio/virtio.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>  
>>  diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
>>  index d735343..ffc22e8 100644
>>  --- a/hw/virtio/virtio.c
>>  +++ b/hw/virtio/virtio.c
>>  @@ -761,6 +761,10 @@ void virtio_queue_notify_vq(VirtQueue *vq)
>>   {
>>       if (vq->vring.desc) {
>>           VirtIODevice *vdev = vq->vdev;
>>  +
>>  +        if (!vq->handle_output) {
>>  +            return;
>>  +        }
> 
> Maybe better to just change line 762 to:
>      if (vq->vring.desc && vq->handle_output) {
> 
> -d

Yes, better.
> 
> 
>>           trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
>>           vq->handle_output(vdev, vq);
>>       }
>>  -- 
>>  1.9.1
>>  
>>  

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [Qemu-devel] [PATCH] virtio: validate the existence of handle_output before calling it
  2015-02-13 20:50 ` Paolo Bonzini
@ 2015-02-15  2:35   ` Jason Wang
  2015-02-16  9:29     ` Paolo Bonzini
  0 siblings, 1 reply; 6+ messages in thread
From: Jason Wang @ 2015-02-15  2:35 UTC (permalink / raw)
  To: Paolo Bonzini; +Cc: qemu-devel



On Sat, Feb 14, 2015 at 4:50 AM, Paolo Bonzini <pbonzini@redhat.com> 
wrote:
> 
> 
> On 12/02/2015 04:05, Jason Wang wrote:
>>  We don't validate the existence of handle_output which may let a 
>> buggy
>>  guest to trigger a SIGSEV easily. Fix this by validate its existence
>>  before.
>>  
>>  Cc: qemu-stable@nongnu.org
>>  Cc: Anthony Liguori <aliguori@amazon.com>
>>  Cc: Michael S. Tsirkin <mst@redhat.com>
>>  Signed-off-by: Jason Wang <jasowang@redhat.com>
> 
> Which queue was causing this?
> 
> Paolo

The queue that was not used by the device. Though qemu does not use 
them, but it allows guest to do some basic programming. e.g: (for 1q 
virtio-net)

1) write 10 to queue_sel
2) setup an arbitrary pfn
3) then notify queue 10

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [Qemu-devel] [PATCH] virtio: validate the existence of handle_output before calling it
  2015-02-15  2:35   ` Jason Wang
@ 2015-02-16  9:29     ` Paolo Bonzini
  0 siblings, 0 replies; 6+ messages in thread
From: Paolo Bonzini @ 2015-02-16  9:29 UTC (permalink / raw)
  To: Jason Wang; +Cc: qemu-devel



On 15/02/2015 03:35, Jason Wang wrote:
> 
> 
> On Sat, Feb 14, 2015 at 4:50 AM, Paolo Bonzini <pbonzini@redhat.com> wrote:
>>
>>
>> On 12/02/2015 04:05, Jason Wang wrote:
>>>  We don't validate the existence of handle_output which may let a buggy
>>>  guest to trigger a SIGSEV easily. Fix this by validate its existence
>>>  before.
>>>  
>>>  Cc: qemu-stable@nongnu.org
>>>  Cc: Anthony Liguori <aliguori@amazon.com>
>>>  Cc: Michael S. Tsirkin <mst@redhat.com>
>>>  Signed-off-by: Jason Wang <jasowang@redhat.com>
>>
>> Which queue was causing this?
>>
>> Paolo
> 
> The queue that was not used by the device. Though qemu does not use
> them, but it allows guest to do some basic programming. e.g: (for 1q
> virtio-net)
> 
> 1) write 10 to queue_sel
> 2) setup an arbitrary pfn
> 3) then notify queue 10

Oh, I see.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2015-02-16  9:30 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-02-12  3:05 [Qemu-devel] [PATCH] virtio: validate the existence of handle_output before calling it Jason Wang
2015-02-13 20:18 ` Don Koch
2015-02-15  2:32   ` Jason Wang
2015-02-13 20:50 ` Paolo Bonzini
2015-02-15  2:35   ` Jason Wang
2015-02-16  9:29     ` Paolo Bonzini

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).