mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-12-17 21:26:13 -07:00
d3d74d6fe0
A broken guest may send a request without providing buffers for the reply
or for the request itself, and virtqueue_pop() will return an element with
either in_num == 0 or out_num == 0.
All 9P requests are expected to start with the following 7-byte header:
uint32_t size_le;
uint8_t id;
uint16_t tag_le;
If iov_to_buf() fails to return these 7 bytes, then something is wrong in
the guest.
In both cases, it is wrong to crash QEMU, since the root cause lies in the
guest.
This patch hence does the following:
- keep the check of in_num since pdu_complete() assumes it has enough
space to store the reply and we will send something broken to the guest
- let iov_to_buf() handle out_num == 0, since it will return 0 just like
if the guest had provided an zero-sized buffer.
- call virtio_error() to inform the guest that the device is now broken,
instead of aborting
- detach the request from the virtqueue and free it
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
||
|---|---|---|
| .. | ||
| 9p-handle.c | ||
| 9p-local.c | ||
| 9p-posix-acl.c | ||
| 9p-proxy.c | ||
| 9p-proxy.h | ||
| 9p-synth.c | ||
| 9p-synth.h | ||
| 9p-xattr-user.c | ||
| 9p-xattr.c | ||
| 9p-xattr.h | ||
| 9p.c | ||
| 9p.h | ||
| codir.c | ||
| cofile.c | ||
| cofs.c | ||
| coth.c | ||
| coth.h | ||
| coxattr.c | ||
| Makefile.objs | ||
| trace-events | ||
| virtio-9p-device.c | ||
| virtio-9p.h | ||