Message ID | 20180328133435.20112-1-linzhecheng@huawei.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
On Wed, Mar 28, 2018 at 09:34:35PM +0800, linzhecheng wrote: > Check device having the feature of VIRTIO_CONSOLE_F_EMERG_WRITE before > get config->emerg_wr. It is neccessary because sizeof(virtio_console_config) > is 8 byte if VirtIOSerial doesn't have the feature of > VIRTIO_CONSOLE_F_EMERG_WRITE(see virtio_serial_device_realize), > read/write emerg_wr will lead to heap-over-flow. > > Signed-off-by: linzhecheng <linzhecheng@huawei.com> Michael or Paolo: Please merge for QEMU 2.12 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
On Wed, Apr 04, 2018 at 10:53:22AM +0100, Stefan Hajnoczi wrote: > On Wed, Mar 28, 2018 at 09:34:35PM +0800, linzhecheng wrote: > > Check device having the feature of VIRTIO_CONSOLE_F_EMERG_WRITE before > > get config->emerg_wr. It is neccessary because sizeof(virtio_console_config) > > is 8 byte if VirtIOSerial doesn't have the feature of > > VIRTIO_CONSOLE_F_EMERG_WRITE(see virtio_serial_device_realize), > > read/write emerg_wr will lead to heap-over-flow. > > > > Signed-off-by: linzhecheng <linzhecheng@huawei.com> > > Michael or Paolo: Please merge for QEMU 2.12 > > Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Will merge.
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c index 9470bd7be7..d2dd8ab502 100644 --- a/hw/char/virtio-serial-bus.c +++ b/hw/char/virtio-serial-bus.c @@ -580,13 +580,16 @@ static void set_config(VirtIODevice *vdev, const uint8_t *config_data) VirtIOSerial *vser = VIRTIO_SERIAL(vdev); struct virtio_console_config *config = (struct virtio_console_config *)config_data; - uint8_t emerg_wr_lo = le32_to_cpu(config->emerg_wr); VirtIOSerialPort *port = find_first_connected_console(vser); VirtIOSerialPortClass *vsc; + uint8_t emerg_wr_lo; - if (!config->emerg_wr) { + if (!virtio_has_feature(vser->host_features, + VIRTIO_CONSOLE_F_EMERG_WRITE) || !config->emerg_wr) { return; } + + emerg_wr_lo = le32_to_cpu(config->emerg_wr); /* Make sure we don't misdetect an emergency write when the guest * does a short config write after an emergency write. */ config->emerg_wr = 0;
Check device having the feature of VIRTIO_CONSOLE_F_EMERG_WRITE before get config->emerg_wr. It is neccessary because sizeof(virtio_console_config) is 8 byte if VirtIOSerial doesn't have the feature of VIRTIO_CONSOLE_F_EMERG_WRITE(see virtio_serial_device_realize), read/write emerg_wr will lead to heap-over-flow. Signed-off-by: linzhecheng <linzhecheng@huawei.com>