From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59830) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X1IQj-0006Rz-Nd for qemu-devel@nongnu.org; Sun, 29 Jun 2014 12:58:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X1IQc-0003BQ-JG for qemu-devel@nongnu.org; Sun, 29 Jun 2014 12:58:17 -0400 Received: from mx1.redhat.com ([209.132.183.28]:62450) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X1IQc-0003BJ-Ao for qemu-devel@nongnu.org; Sun, 29 Jun 2014 12:58:10 -0400 Date: Sun, 29 Jun 2014 19:58:33 +0300 From: "Michael S. Tsirkin" Message-ID: <1404060115-27410-10-git-send-email-mst@redhat.com> References: <1404060115-27410-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1404060115-27410-1-git-send-email-mst@redhat.com> Subject: [Qemu-devel] [PULL 09/37] Allow mismatched virtio config-len List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , "Dr. David Alan Gilbert" , Anthony Liguori From: "Dr. David Alan Gilbert" Commit 'virtio: validate config_len on load' restricted config_len loaded from the wire to match the config_len that the device had. Unfortunately, there are cases where this isn't true, the one we found it on was the wce addition in virtio-blk. Allow mismatched config-lengths: *) If the version on the wire is shorter then fine *) If the version on the wire is longer, load what we have space for and skip the rest. (This is mst@redhat.com's rework of what I originally posted) Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/virtio/virtio.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index a3082d5..c1d538c 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -926,12 +926,18 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f) return -1; } config_len = qemu_get_be32(f); - if (config_len != vdev->config_len) { - error_report("Unexpected config length 0x%x. Expected 0x%zx", - config_len, vdev->config_len); - return -1; + + /* + * There are cases where the incoming config can be bigger or smaller + * than what we have; so load what we have space for, and skip + * any excess that's in the stream. + */ + qemu_get_buffer(f, vdev->config, MIN(config_len, vdev->config_len)); + + while (config_len > vdev->config_len) { + qemu_get_byte(f); + config_len--; } - qemu_get_buffer(f, vdev->config, vdev->config_len); num = qemu_get_be32(f); -- MST