35 lines
1.1 KiB
Diff
35 lines
1.1 KiB
Diff
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Date: Wed, 27 Jul 2016 21:07:56 +0530
|
|
Subject: [PATCH] virtio: check vring descriptor buffer length
|
|
|
|
virtio back end uses set of buffers to facilitate I/O operations.
|
|
An infinite loop unfolds in virtqueue_pop() if a buffer was
|
|
of zero size. Add check to avoid it.
|
|
|
|
Reported-by: Li Qiang <liqiang6-s@360.cn>
|
|
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
|
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
(cherry picked from commit 1e7aed70144b4673fc26e73062064b6724795e5f)
|
|
---
|
|
hw/virtio/virtio.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
|
|
index 519bb03..20c4f39 100644
|
|
--- a/hw/virtio/virtio.c
|
|
+++ b/hw/virtio/virtio.c
|
|
@@ -458,6 +458,11 @@ static void virtqueue_map_desc(unsigned int *p_num_sg, hwaddr *addr, struct iove
|
|
unsigned num_sg = *p_num_sg;
|
|
assert(num_sg <= max_num_sg);
|
|
|
|
+ if (!sz) {
|
|
+ error_report("virtio: zero sized buffers are not allowed");
|
|
+ exit(1);
|
|
+ }
|
|
+
|
|
while (sz) {
|
|
hwaddr len = sz;
|
|
|