[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL v2 31/38] contrib/vhost-user-blk: fix get_config() information lea
From: |
Michael S. Tsirkin |
Subject: |
[PULL v2 31/38] contrib/vhost-user-blk: fix get_config() information leak |
Date: |
Tue, 3 Nov 2020 23:52:05 -0500 |
From: Stefan Hajnoczi <stefanha@redhat.com>
Refuse get_config() in excess of sizeof(struct virtio_blk_config).
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201027173528.213464-6-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
contrib/vhost-user-blk/vhost-user-blk.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/contrib/vhost-user-blk/vhost-user-blk.c
b/contrib/vhost-user-blk/vhost-user-blk.c
index 25eccd02b5..caad88637e 100644
--- a/contrib/vhost-user-blk/vhost-user-blk.c
+++ b/contrib/vhost-user-blk/vhost-user-blk.c
@@ -404,6 +404,8 @@ vub_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len)
VugDev *gdev;
VubDev *vdev_blk;
+ g_return_val_if_fail(len <= sizeof(struct virtio_blk_config), -1);
+
gdev = container_of(vu_dev, VugDev, parent);
vdev_blk = container_of(gdev, VubDev, parent);
memcpy(config, &vdev_blk->blkcfg, len);
--
MST
- [PULL v2 14/38] virtio-iommu: Store memory region in endpoint struct, (continued)
- [PULL v2 14/38] virtio-iommu: Store memory region in endpoint struct, Michael S. Tsirkin, 2020/11/03
- [PULL v2 34/38] libqtest: add qtest_socket_server(), Michael S. Tsirkin, 2020/11/03
- [PULL v2 35/38] vhost-user-blk-test: rename destroy_drive() to destroy_file(), Michael S. Tsirkin, 2020/11/03
- [PULL v2 36/38] vhost-user-blk-test: close fork child file descriptors, Michael S. Tsirkin, 2020/11/03
- [PULL v2 28/38] configure: introduce --enable-vhost-user-blk-server, Michael S. Tsirkin, 2020/11/03
- [PULL v2 33/38] tests/qtest: add multi-queue test case to vhost-user-blk-test, Michael S. Tsirkin, 2020/11/03
- [PULL v2 38/38] vhost-user-blk-test: fix races by using fd passing, Michael S. Tsirkin, 2020/11/03
- [PULL v2 32/38] test: new qTest case to test the vhost-user-blk-server, Michael S. Tsirkin, 2020/11/03
- [PULL v2 18/38] virtio-iommu: Add notify_flag_changed() memory region callback, Michael S. Tsirkin, 2020/11/03
- [PULL v2 16/38] virtio-iommu: Call memory notifiers in attach/detach, Michael S. Tsirkin, 2020/11/03
- [PULL v2 31/38] contrib/vhost-user-blk: fix get_config() information leak,
Michael S. Tsirkin <=
- [PULL v2 10/38] hw/acpi : add spaces around operator, Michael S. Tsirkin, 2020/11/04
- [PULL v2 37/38] vhost-user-blk-test: drop unused return value, Michael S. Tsirkin, 2020/11/04
- Re: [PULL v2 00/38] pc,pci,vhost,virtio: fixes, Peter Maydell, 2020/11/04