[Qemu-devel] [PATCHv2] filter-mirror: segfault when specifying non existent device

[Qemu-devel] [PATCHv2] filter-mirror: segfault when specifying non existent device

[Eduardo Otubo]

v2:
    Removed "err:" label from the end of the function and replaced by
    two separate error messages. One when outdev is not specified and
    one when outdev does not exist.

    Fixed the error message that was referencing nf->netdev_id and not
    s->outdev.

When using filter-mirror like the example below where the interface
'ndev0' does not exist on the host, QEMU crashes into segmentation
fault.

 $ qemu-system-x86_64 -S -machine pc -netdev user,id=ndev0 -object filter-mirror,id=test-object,netdev=ndev0

This happens because the function filter_mirror_setup() does not checks
if the device actually exists and still keep on processing calling
qemu_chr_find(). This patch fixes this issue.

Signed-off-by: Eduardo Otubo <otubo@redhat.com>
---
 net/filter-mirror.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index 90e2c92337..ce0dc23c2a 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -213,6 +213,12 @@ static void filter_mirror_setup(NetFilterState *nf, Error **errp)
     MirrorState *s = FILTER_MIRROR(nf);
     Chardev *chr;
 
+    if (s->outdev == NULL) {
+        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND, "filter-mirror parameter"\
+                  " 'outdev' cannot be empty");
+        return;
+    }
+
     chr = qemu_chr_find(s->outdev);
     if (chr == NULL) {
         error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
-- 
2.13.5

Re: [Qemu-devel] [PATCHv2] filter-mirror: segfault when specifying non existent device

[Zhang Chen]

2017-09-29 12:03 GMT+00:00 Eduardo Otubo <otubo@redhat.com>:

> v2:
>     Removed "err:" label from the end of the function and replaced by
>     two separate error messages. One when outdev is not specified and
>     one when outdev does not exist.
>
>     Fixed the error message that was referencing nf->netdev_id and not
>     s->outdev.
>
> When using filter-mirror like the example below where the interface
> 'ndev0' does not exist on the host, QEMU crashes into segmentation
> fault.
>
>  $ qemu-system-x86_64 -S -machine pc -netdev user,id=ndev0 -object
> filter-mirror,id=test-object,netdev=ndev0
>
> This happens because the function filter_mirror_setup() does not checks
> if the device actually exists and still keep on processing calling
> qemu_chr_find(). This patch fixes this issue.
>
> Signed-off-by: Eduardo Otubo <otubo@redhat.com>
>


 Reviewed-by: Zhang Chen <zhangckid@gmail.com>

 Thanks
 Zhang Chen


> ---
>  net/filter-mirror.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/net/filter-mirror.c b/net/filter-mirror.c
> index 90e2c92337..ce0dc23c2a 100644
> --- a/net/filter-mirror.c
> +++ b/net/filter-mirror.c
> @@ -213,6 +213,12 @@ static void filter_mirror_setup(NetFilterState *nf,
> Error **errp)
>      MirrorState *s = FILTER_MIRROR(nf);
>      Chardev *chr;
>
> +    if (s->outdev == NULL) {
> +        error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND, "filter-mirror
> parameter"\
> +                  " 'outdev' cannot be empty");
> +        return;
> +    }
> +
>      chr = qemu_chr_find(s->outdev);
>      if (chr == NULL) {
>          error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
> --
> 2.13.5
>
>
>

Re: [Qemu-devel] [PATCHv2] filter-mirror: segfault when specifying non existent device

[Michael Tokarev]

29.09.2017 15:03, Eduardo Otubo wrote:
> v2:
>     Removed "err:" label from the end of the function and replaced by
>     two separate error messages. One when outdev is not specified and
>     one when outdev does not exist.
> 
>     Fixed the error message that was referencing nf->netdev_id and not
>     s->outdev.
> 
> When using filter-mirror like the example below where the interface
> 'ndev0' does not exist on the host, QEMU crashes into segmentation
> fault.
> 
>  $ qemu-system-x86_64 -S -machine pc -netdev user,id=ndev0 -object filter-mirror,id=test-object,netdev=ndev0
> 
> This happens because the function filter_mirror_setup() does not checks
> if the device actually exists and still keep on processing calling
> qemu_chr_find(). This patch fixes this issue.

Applied to -trivial, with a tiny fix in the commit message (checkS).

Thanks!

/mjt