]>
Commit | Line | Data |
---|---|---|
68a30562 | 1 | From 1723b5e7962eb077353bab0772ca8114774b6c60 Mon Sep 17 00:00:00 2001 |
d37e80a3 WB |
2 | From: Prasad J Pandit <pjp@fedoraproject.org> |
3 | Date: Mon, 19 Sep 2016 23:55:45 +0530 | |
68a30562 | 4 | Subject: [PATCH 4/7] virtio: add check for descriptor's mapped address |
d37e80a3 WB |
5 | |
6 | virtio back end uses set of buffers to facilitate I/O operations. | |
7 | If its size is too large, 'cpu_physical_memory_map' could return | |
8 | a null address. This would result in a null dereference while | |
9 | un-mapping descriptors. Add check to avoid it. | |
10 | ||
11 | Reported-by: Qinghao Tang <luodalongde@gmail.com> | |
12 | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> | |
13 | Reviewed-by: Michael S. Tsirkin <mst@redhat.com> | |
14 | Signed-off-by: Michael S. Tsirkin <mst@redhat.com> | |
15 | Reviewed-by: Laszlo Ersek <lersek@redhat.com> | |
16 | --- | |
17 | hw/virtio/virtio.c | 5 +++++ | |
18 | 1 file changed, 5 insertions(+) | |
19 | ||
20 | diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c | |
68a30562 | 21 | index 74c085c..eabe573 100644 |
d37e80a3 WB |
22 | --- a/hw/virtio/virtio.c |
23 | +++ b/hw/virtio/virtio.c | |
68a30562 | 24 | @@ -473,6 +473,11 @@ static void virtqueue_map_desc(unsigned int *p_num_sg, hwaddr *addr, struct iove |
d37e80a3 WB |
25 | } |
26 | ||
27 | iov[num_sg].iov_base = cpu_physical_memory_map(pa, &len, is_write); | |
28 | + if (!iov[num_sg].iov_base) { | |
29 | + error_report("virtio: bogus descriptor or out of resources"); | |
30 | + exit(1); | |
31 | + } | |
32 | + | |
33 | iov[num_sg].iov_len = len; | |
34 | addr[num_sg] = pa; | |
35 | ||
36 | -- | |
37 | 2.1.4 | |
38 |