From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:57519) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UVSek-0004gD-1e for qemu-devel@nongnu.org; Thu, 25 Apr 2013 16:20:39 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UVSei-0000vm-R9 for qemu-devel@nongnu.org; Thu, 25 Apr 2013 16:20:37 -0400 Received: from e23smtp04.au.ibm.com ([202.81.31.146]:44947) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UVSei-0000vb-AH for qemu-devel@nongnu.org; Thu, 25 Apr 2013 16:20:36 -0400 Received: from /spool/local by e23smtp04.au.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 26 Apr 2013 06:08:37 +1000 Received: from d23relay03.au.ibm.com (d23relay03.au.ibm.com [9.190.235.21]) by d23dlp03.au.ibm.com (Postfix) with ESMTP id 94574357804E for ; Fri, 26 Apr 2013 06:20:30 +1000 (EST) Received: from d23av03.au.ibm.com (d23av03.au.ibm.com [9.190.234.97]) by d23relay03.au.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r3PKKJKF16711824 for ; Fri, 26 Apr 2013 06:20:24 +1000 Received: from d23av03.au.ibm.com (loopback [127.0.0.1]) by d23av03.au.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id r3PKKPFL006787 for ; Fri, 26 Apr 2013 06:20:25 +1000 From: Anthony Liguori In-Reply-To: <1366875807-3491-1-git-send-email-jasowang@redhat.com> References: <1366875807-3491-1-git-send-email-jasowang@redhat.com> Date: Thu, 25 Apr 2013 15:20:20 -0500 Message-ID: <87fvyebbwb.fsf@codemonkey.ws> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Subject: Re: [Qemu-devel] [PATCH] virtio: abort on zero config length List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Jason Wang , qemu-devel@nongnu.org, mst@redhat.com Jason Wang writes: > In fact we don't support zero length config length for virtio device. virtio-rng? > And it can lead outbound memory access. So abort on zero config length > to catch the bug earlier. Not sure what you mean, but virtio-rng has a zero length config space. Regards, Anthony Liguori > > Signed-off-by: Jason Wang > --- > hw/virtio/virtio.c | 7 ++----- > 1 files changed, 2 insertions(+), 5 deletions(-) > > diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c > index 1c2282c..a6fa667 100644 > --- a/hw/virtio/virtio.c > +++ b/hw/virtio/virtio.c > @@ -923,6 +923,7 @@ void virtio_init(VirtIODevice *vdev, const char *name, > uint16_t device_id, size_t config_size) > { > int i; > + assert(config_size); > vdev->device_id = device_id; > vdev->status = 0; > vdev->isr = 0; > @@ -938,11 +939,7 @@ void virtio_init(VirtIODevice *vdev, const char *name, > > vdev->name = name; > vdev->config_len = config_size; > - if (vdev->config_len) { > - vdev->config = g_malloc0(config_size); > - } else { > - vdev->config = NULL; > - } > + vdev->config = g_malloc0(config_size); > vdev->vmstate = qemu_add_vm_change_state_handler(virtio_vmstate_change, > vdev); > } > -- > 1.7.1