aboutsummaryrefslogtreecommitdiff
path: root/hw/virtio.c
diff options
context:
space:
mode:
authorStefan Hajnoczi <stefanha@linux.vnet.ibm.com>2011-05-08 22:29:07 +0100
committerMichael S. Tsirkin <mst@redhat.com>2011-06-12 10:33:38 +0300
commit7157e2e23e89adcd436caeab31fdd6b47eded377 (patch)
tree5012c5e003f5d66032ef7892240ad8c9a9abe5eb /hw/virtio.c
parente75ccf2c033fb0503d6cb7ddd0fd1dfa0aa4fc16 (diff)
downloadqemu-7157e2e23e89adcd436caeab31fdd6b47eded377.zip
qemu-7157e2e23e89adcd436caeab31fdd6b47eded377.tar.gz
qemu-7157e2e23e89adcd436caeab31fdd6b47eded377.tar.bz2
virtio: guard against negative vq notifies
The virtio_queue_notify() function checks that the virtqueue number is less than the maximum number of virtqueues. A signed comparison is used but the virtqueue number could be negative if a buggy or malicious guest is run. This results in memory accesses outside of the virtqueue array. It is risky doing input validation in common code instead of at the guest<->host boundary. Note that virtio_queue_set_addr(), virtio_queue_get_addr(), virtio_queue_get_num(), and many other virtio functions do *not* validate the virtqueue number argument. Instead of fixing the comparison in virtio_queue_notify(), move the comparison to the virtio bindings (just like VIRTIO_PCI_QUEUE_SEL) where we have a uint32_t value and can avoid ever calling into common virtio code if the virtqueue number is invalid. Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/virtio.c')
-rw-r--r--hw/virtio.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/hw/virtio.c b/hw/virtio.c
index 6e8814c..a651860 100644
--- a/hw/virtio.c
+++ b/hw/virtio.c
@@ -585,9 +585,7 @@ void virtio_queue_notify_vq(VirtQueue *vq)
void virtio_queue_notify(VirtIODevice *vdev, int n)
{
- if (n < VIRTIO_PCI_QUEUE_MAX) {
- virtio_queue_notify_vq(&vdev->vq[n]);
- }
+ virtio_queue_notify_vq(&vdev->vq[n]);
}
uint16_t virtio_queue_vector(VirtIODevice *vdev, int n)