ivshmem: Check ivshmem_read() size argument
The third argument to the fd_read() callback implemented by ivshmem_read() is the number of bytes, not a flags field. Fix this and check we received enough bytes before accessing the buffer pointer. Cc: Cam Macdonell <cam@cs.ualberta.ca> Reported-by: Sebastian Krahmer <krahmer@suse.de> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> [AF: Handle partial reads via FIFO] Reported-by: Peter Maydell <peter.maydell@linaro.org> Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
e64e353590
commit
a2e9011b41
@ -24,6 +24,7 @@
|
||||
#include "migration/migration.h"
|
||||
#include "qapi/qmp/qerror.h"
|
||||
#include "qemu/event_notifier.h"
|
||||
#include "qemu/fifo8.h"
|
||||
#include "sysemu/char.h"
|
||||
|
||||
#include <sys/mman.h>
|
||||
@ -73,6 +74,7 @@ typedef struct IVShmemState {
|
||||
|
||||
CharDriverState **eventfd_chr;
|
||||
CharDriverState *server_chr;
|
||||
Fifo8 incoming_fifo;
|
||||
MemoryRegion ivshmem_mmio;
|
||||
|
||||
/* We might need to register the BAR before we actually have the memory.
|
||||
@ -424,14 +426,35 @@ static void increase_dynamic_storage(IVShmemState *s, int new_min_size) {
|
||||
}
|
||||
}
|
||||
|
||||
static void ivshmem_read(void *opaque, const uint8_t * buf, int flags)
|
||||
static void ivshmem_read(void *opaque, const uint8_t *buf, int size)
|
||||
{
|
||||
IVShmemState *s = opaque;
|
||||
int incoming_fd, tmp_fd;
|
||||
int guest_max_eventfd;
|
||||
long incoming_posn;
|
||||
|
||||
memcpy(&incoming_posn, buf, sizeof(long));
|
||||
if (fifo8_is_empty(&s->incoming_fifo) && size == sizeof(incoming_posn)) {
|
||||
memcpy(&incoming_posn, buf, size);
|
||||
} else {
|
||||
const uint8_t *p;
|
||||
uint32_t num;
|
||||
|
||||
IVSHMEM_DPRINTF("short read of %d bytes\n", size);
|
||||
num = MAX(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
|
||||
fifo8_push_all(&s->incoming_fifo, buf, num);
|
||||
if (fifo8_num_used(&s->incoming_fifo) < sizeof(incoming_posn)) {
|
||||
return;
|
||||
}
|
||||
size -= num;
|
||||
buf += num;
|
||||
p = fifo8_pop_buf(&s->incoming_fifo, sizeof(incoming_posn), &num);
|
||||
g_assert(num == sizeof(incoming_posn));
|
||||
memcpy(&incoming_posn, p, sizeof(incoming_posn));
|
||||
if (size > 0) {
|
||||
fifo8_push_all(&s->incoming_fifo, buf, size);
|
||||
}
|
||||
}
|
||||
|
||||
/* pick off s->server_chr->msgfd and store it, posn should accompany msg */
|
||||
tmp_fd = qemu_chr_fe_get_msgfd(s->server_chr);
|
||||
IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, tmp_fd);
|
||||
@ -663,6 +686,8 @@ static int pci_ivshmem_init(PCIDevice *dev)
|
||||
s->ivshmem_size = ivshmem_get_size(s);
|
||||
}
|
||||
|
||||
fifo8_create(&s->incoming_fifo, sizeof(long));
|
||||
|
||||
register_savevm(DEVICE(dev), "ivshmem", 0, 0, ivshmem_save, ivshmem_load,
|
||||
dev);
|
||||
|
||||
@ -796,6 +821,7 @@ static void pci_ivshmem_uninit(PCIDevice *dev)
|
||||
memory_region_del_subregion(&s->bar, &s->ivshmem);
|
||||
vmstate_unregister_ram(&s->ivshmem, DEVICE(dev));
|
||||
unregister_savevm(DEVICE(dev), "ivshmem", s);
|
||||
fifo8_destroy(&s->incoming_fifo);
|
||||
}
|
||||
|
||||
static Property ivshmem_properties[] = {
|
||||
|
Loading…
Reference in New Issue
Block a user