Commit fb1131b6 authored by Stefan Hajnoczi's avatar Stefan Hajnoczi Committed by Michael S. Tsirkin
Browse files

virtio: handle virtqueue_get_head() errors 



Stop processing the vring if virtqueue_get_head() fetches an
out-of-bounds head index.

Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: default avatarCornelia Huck <cornelia.huck@de.ibm.com>
Reviewed-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: default avatarCornelia Huck <cornelia.huck@de.ibm.com>
parent 4355c1ab

hw/virtio/virtio.c

+17 −10
Original line number Diff line number Diff line
@@ -360,21 +360,20 @@ static int virtqueue_num_heads(VirtQueue *vq, unsigned int idx) 
    return num_heads;

}



static unsigned int virtqueue_get_head(VirtQueue *vq, unsigned int idx)

static bool virtqueue_get_head(VirtQueue *vq, unsigned int idx,

                               unsigned int *head)

{

    unsigned int head;



    /* Grab the next descriptor number they're advertising, and increment

     * the index we've seen. */

    head = vring_avail_ring(vq, idx % vq->vring.num);

    *head = vring_avail_ring(vq, idx % vq->vring.num);



    /* If their number is silly, that's a fatal mistake. */

    if (head >= vq->vring.num) {

        error_report("Guest says index %u is available", head);

        exit(1);

    if (*head >= vq->vring.num) {

        virtio_error(vq->vdev, "Guest says index %u is available", *head);

        return false;

    }



    return head;

    return true;

}



enum {
@@ -426,7 +425,11 @@ void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes, 


        max = vq->vring.num;

        num_bufs = total_bufs;

        i = virtqueue_get_head(vq, idx++);



        if (!virtqueue_get_head(vq, idx++, &i)) {

            goto err;

        }



        desc_pa = vq->vring.desc;

        vring_desc_read(vdev, &desc, desc_pa, i);
@@ -660,11 +663,15 @@ void *virtqueue_pop(VirtQueue *vq, size_t sz) 
        return NULL;

    }



    i = head = virtqueue_get_head(vq, vq->last_avail_idx++);

    if (!virtqueue_get_head(vq, vq->last_avail_idx++, &head)) {

        return NULL;

    }



    if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {

        vring_set_avail_event(vq, vq->last_avail_idx);

    }



    i = head;

    vring_desc_read(vdev, &desc, desc_pa, i);

    if (desc.flags & VRING_DESC_F_INDIRECT) {

        if (desc.len % sizeof(VRingDesc)) {