haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

virtio: validate the existence of handle_output before calling it

Browse source 
We don't validate the existence of handle_output which may let a buggy
guest to trigger a SIGSEV easily. E.g:

1) write 10 to queue_sel to a virtio net device with only 1 queue
2) setup an arbitrary pfn
3) then notify queue 10

Fixing this by validating the existence of handle_output before.

Cc: qemu-stable@nongnu.org
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Don Koch <dkoch@verizon.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
This commit is contained in:
Jason Wang 2015-03-12 17:50:18 +08:00 committed by Michael S. Tsirkin
parent 18bf9e2f37
commit 9e0f5b8108
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
hw/virtio/virtio.c
View file

@ -759,8 +759,9 @@ void virtio_queue_set_align(VirtIODevice *vdev, int n, int align)
void virtio_queue_notify_vq(VirtQueue *vq)
{
if (vq->vring.desc) {
if (vq->vring.desc && vq->handle_output) {
VirtIODevice *vdev = vq->vdev;
trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
vq->handle_output(vdev, vq);
}