virtio-gpu: check if the resource already exists in virtio_gpu_load()

[Qemu-devel] [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load()

Li Qiang posted 1 patch 4 years, 10 months ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20190628161358.10400-1-liq3ea@163.com

Test s390x failed

Test checkpatch passed

Test FreeBSD passed

Test asan passed

Test docker-mingw@fedora passed

Test docker-clang@ubuntu passed

Maintainers: "Michael S. Tsirkin" <mst@redhat.com>, Gerd Hoffmann <kraxel@redhat.com>

hw/display/virtio-gpu.c | 5 +++++
1 file changed, 5 insertions(+)

Expand all Fold all

[Qemu-devel] [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load()

Posted by Li Qiang 4 years, 10 months ago

While loading virtio-gpu, the data can be malicious, we
should check if the resource already exists.

Signed-off-by: Li Qiang <liq3ea@163.com>
---
 hw/display/virtio-gpu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 2b0f66b1d6..f1ebed9959 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
 
     resource_id = qemu_get_be32(f);
     while (resource_id != 0) {
+        res = virtio_gpu_find_resource(g, resource_id);
+        if (res) {
+            return -EINVAL;
+        }
+
         res = g_new0(struct virtio_gpu_simple_resource, 1);
         res->resource_id = resource_id;
         res->width = qemu_get_be32(f);
-- 
2.17.1

Re: [Qemu-devel] [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load()

Posted by Michael Tokarev 4 years, 8 months ago

28.06.2019 19:13, Li Qiang wrote:
> While loading virtio-gpu, the data can be malicious, we
> should check if the resource already exists.
> 
> Signed-off-by: Li Qiang <liq3ea@163.com>
> ---
>  hw/display/virtio-gpu.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
> index 2b0f66b1d6..f1ebed9959 100644
> --- a/hw/display/virtio-gpu.c
> +++ b/hw/display/virtio-gpu.c
> @@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
>  
>      resource_id = qemu_get_be32(f);
>      while (resource_id != 0) {
> +        res = virtio_gpu_find_resource(g, resource_id);
> +        if (res) {
> +            return -EINVAL;

  EEXIST?

/mjt

Re: [Qemu-devel] [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load()

Posted by Marc-André Lureau 4 years, 9 months ago

On Fri, Jun 28, 2019 at 8:53 PM Li Qiang <liq3ea@163.com> wrote:
>
> While loading virtio-gpu, the data can be malicious, we
> should check if the resource already exists.
>
> Signed-off-by: Li Qiang <liq3ea@163.com>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

> ---
>  hw/display/virtio-gpu.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
> index 2b0f66b1d6..f1ebed9959 100644
> --- a/hw/display/virtio-gpu.c
> +++ b/hw/display/virtio-gpu.c
> @@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
>
>      resource_id = qemu_get_be32(f);
>      while (resource_id != 0) {
> +        res = virtio_gpu_find_resource(g, resource_id);
> +        if (res) {
> +            return -EINVAL;
> +        }
> +
>          res = g_new0(struct virtio_gpu_simple_resource, 1);
>          res->resource_id = resource_id;
>          res->width = qemu_get_be32(f);
> --
> 2.17.1
>
>
>


-- 
Marc-André Lureau