All of lore.kernel.org
 help / color / mirror / Atom feed
From: Stefan Hajnoczi <stefanha@redhat.com>
To: qemu-devel@nongnu.org
Cc: Laurent Vivier <lvivier@redhat.com>,
	Kevin Wolf <kwolf@redhat.com>, Thomas Huth <thuth@redhat.com>,
	qemu-block@nongnu.org, "Michael S. Tsirkin" <mst@redhat.com>,
	Coiby Xu <coiby.xu@gmail.com>,
	Raphael Norwitz <raphael.norwitz@nutanix.com>,
	Stefan Hajnoczi <stefanha@redhat.com>,
	Paolo Bonzini <pbonzini@redhat.com>,
	Max Reitz <mreitz@redhat.com>
Subject: [PATCH 04/12] block/export: fix vhost-user-blk get_config() information leak
Date: Tue, 27 Oct 2020 17:35:20 +0000	[thread overview]
Message-ID: <20201027173528.213464-5-stefanha@redhat.com> (raw)
In-Reply-To: <20201027173528.213464-1-stefanha@redhat.com>

Refuse get_config() requests in excess of sizeof(struct virtio_blk_config).

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/export/vhost-user-blk-server.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
index 33cc0818b8..62672d1cb9 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -266,6 +266,9 @@ vu_blk_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len)
 {
     VuServer *server = container_of(vu_dev, VuServer, vu_dev);
     VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server);
+
+    g_return_val_if_fail(len <= sizeof(struct virtio_blk_config), -1);
+
     memcpy(config, &vexp->blkcfg, len);
     return 0;
 }
-- 
2.26.2


  parent reply	other threads:[~2020-10-27 17:41 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-27 17:35 [PATCH 00/12] block/export: vhost-user-blk server cleanups and tests Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 01/12] libvhost-user: follow QEMU comment style Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 02/12] configure: introduce --enable-vhost-user-blk-server Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 03/12] block/export: make vhost-user-blk config space little-endian Stefan Hajnoczi
2020-10-27 17:35 ` Stefan Hajnoczi [this message]
2020-10-27 17:35 ` [PATCH 05/12] contrib/vhost-user-blk: fix get_config() information leak Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 06/12] test: new qTest case to test the vhost-user-blk-server Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 07/12] tests/qtest: add multi-queue test case to vhost-user-blk-test Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 08/12] libqtest: add qtest_socket_server() Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 09/12] vhost-user-blk-test: rename destroy_drive() to destroy_file() Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 10/12] vhost-user-blk-test: close fork child file descriptors Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 11/12] vhost-user-blk-test: drop unused return value Stefan Hajnoczi
2020-10-27 17:35 ` [PATCH 12/12] vhost-user-blk-test: fix races by using fd passing Stefan Hajnoczi
2020-10-30 12:42 ` [PATCH 00/12] block/export: vhost-user-blk server cleanups and tests Michael S. Tsirkin
2020-11-02 10:43   ` Michael S. Tsirkin
2020-11-02 17:00     ` Stefan Hajnoczi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201027173528.213464-5-stefanha@redhat.com \
    --to=stefanha@redhat.com \
    --cc=coiby.xu@gmail.com \
    --cc=kwolf@redhat.com \
    --cc=lvivier@redhat.com \
    --cc=mreitz@redhat.com \
    --cc=mst@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=qemu-block@nongnu.org \
    --cc=qemu-devel@nongnu.org \
    --cc=raphael.norwitz@nutanix.com \
    --cc=thuth@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.