haraldwolff
/
qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tap: fix NULL dereference when passing invalid parameters to tap 

This patch forbid the following invalid parameters to tap:

1) fd and vhostfds were specified but vhostfd were not specified
2) vhostfds were specified but fds were not specified
3) fds and vhostfd were specified

For 1 and 2, net_init_tap_one() will still pass NULL as vhostfdname to
monitor_handle_fd_param(), which may crash the qemu.

Also remove the unnecessary has_fd check.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Stefan Hajnoczi <shajnocz@redhat.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
stable-1.6
Jason Wang 2013-06-04 13:18:17 +08:00 committed by Stefan Hajnoczi
parent 3ffee3cd5f
commit c87826a878
1 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
net/tap.c
View File

@ -698,9 +698,10 @@ int net_init_tap(const NetClientOptions *opts, const char *name,
if (tap->has_fd) {
if (tap->has_ifname || tap->has_script || tap->has_downscript ||
tap->has_vnet_hdr || tap->has_helper || tap->has_queues ||
tap->has_fds) {
tap->has_fds || tap->has_vhostfds) {
error_report("ifname=, script=, downscript=, vnet_hdr=, "
"helper=, queues=, and fds= are invalid with fd=");
"helper=, queues=, fds=, and vhostfds= "
"are invalid with fd=");
return -1;
}
@ -725,9 +726,10 @@ int net_init_tap(const NetClientOptions *opts, const char *name,
if (tap->has_ifname || tap->has_script || tap->has_downscript ||
tap->has_vnet_hdr || tap->has_helper || tap->has_queues ||
tap->has_fd) {
tap->has_vhostfd) {
error_report("ifname=, script=, downscript=, vnet_hdr=, "
"helper=, queues=, and fd= are invalid with fds=");
"helper=, queues=, and vhostfd= "
"are invalid with fds=");
return -1;
}
@ -765,9 +767,9 @@ int net_init_tap(const NetClientOptions *opts, const char *name,
}
} else if (tap->has_helper) {
if (tap->has_ifname || tap->has_script || tap->has_downscript ||
tap->has_vnet_hdr || tap->has_queues || tap->has_fds) {
tap->has_vnet_hdr || tap->has_queues || tap->has_vhostfds) {
error_report("ifname=, script=, downscript=, and vnet_hdr= "
"queues=, and fds= are invalid with helper=");
"queues=, and vhostfds= are invalid with helper=");
return -1;
}
@ -785,6 +787,10 @@ int net_init_tap(const NetClientOptions *opts, const char *name,
return -1;
}
} else {
if (tap->has_vhostfds) {
error_report("vhostfds= is invalid if fds= wasn't specified");
return -1;
}
script = tap->has_script ? tap->script : DEFAULT_NETWORK_SCRIPT;
downscript = tap->has_downscript ? tap->downscript :
DEFAULT_NETWORK_DOWN_SCRIPT;