From nobody Mon Oct 6 14:40:42 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1601366227; cv=none; d=zohomail.com; s=zohoarc; b=meOOYP2B1KK5ssc/0bCQaPDeuJ2UINVbFGF5DwMEHXT2gW9PNor7BTuy7TLYIBkHxKmmTyLCjt2p+UgGvCJs+1z2uyvYU6Tfr3qvSAo6aZLAsG44jvbK2F5iaQzLdxmPSUFRUJUJYF5W3AfgeM+faw9KGEr6wZbvmkhJLsY2lA8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1601366227; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=zmse96ix9uI8MiyDpIwEzkgRhtE5hIeu3p6tVRZ90cA=; b=h2+k3ATxtihjtqRmUb5gNzqIUKX7ttvVl23B2iiGLhyo4gHHEq5IH+ZZxSyUFCEx1OKC59HDnyqIoWqIbn2n94LAo59L71vzAs8JPFmXWYIUoDHF9XLItgZmDhkTfsj4HeC7KsJWUb+JIg4I+NhDq64XPf25sb5KKNq1JGazmLk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1601366227009173.23106600984647; Tue, 29 Sep 2020 00:57:07 -0700 (PDT) Received: from localhost ([::1]:57542 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kNAVV-0004iR-Q6 for importer@patchew.org; Tue, 29 Sep 2020 03:57:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:59352) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kNA1p-00019K-OE for qemu-devel@nongnu.org; Tue, 29 Sep 2020 03:26:25 -0400 Received: from us-smtp-delivery-124.mimecast.com ([63.128.21.124]:57345) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1kNA1n-0002eZ-Mt for qemu-devel@nongnu.org; Tue, 29 Sep 2020 03:26:25 -0400 Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-275-A7_EiXG3M0CU0BNSCdQw7g-1; Tue, 29 Sep 2020 03:23:12 -0400 Received: by mail-wr1-f69.google.com with SMTP id v5so1385605wrr.0 for ; Tue, 29 Sep 2020 00:23:12 -0700 (PDT) Received: from redhat.com (bzq-79-179-71-128.red.bezeqint.net. [79.179.71.128]) by smtp.gmail.com with ESMTPSA id 88sm5118664wrl.76.2020.09.29.00.23.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 29 Sep 2020 00:23:10 -0700 (PDT) Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1601364383; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=zmse96ix9uI8MiyDpIwEzkgRhtE5hIeu3p6tVRZ90cA=; b=jMyqSTEpN7y/tyHV3xcyOVNajg6RqNm95/WfGJNRP5Iv9jdhJ4dbc5FxJUeubINErjQEBj B4H16dgeDi4Y0L/jLdI9TV9xse1+AiD2Bs7Q5btdhUrn/Tc4Ot9kVj4gVk2/6eSiRAxyeQ lJeXKQsFAhJSzL3Pgs965iBnauYwUYM= X-MC-Unique: A7_EiXG3M0CU0BNSCdQw7g-1 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=zmse96ix9uI8MiyDpIwEzkgRhtE5hIeu3p6tVRZ90cA=; b=pElhEvtJ0wPb8ivNp0IxZQYrkZ04yMqWwhDqrUv6arq1GnZG28sc6/nUhDmyRQuc0G 9vIWy/d3UTCmbhE8+oOHm+n6+uymyFXMmrgQ4uqTVhCUVqEW9RcMNmDnERVzM4UYldJ2 b6x+JvRAnQ7JH0Y366pZ3aB78aLQVHR37DmduapyI3SCQcKR7Y5K8CRJh8OyuVunVC76 U3L+XwFEgBIWi8i4vmanHTgeYBz4d7ZOazvjA/cLW+M1gEO84BfYsfe5d9enUC0g7L2B maWaSeu1lRzXWNd3ZNS+CQusrxhV4AlNx5SbWRFCz73oMzyCg5y4Z8+RaiNn705+PPA5 VAhw== X-Gm-Message-State: AOAM531BvTAvbAVAKrE0+Ww3N09D5hgcqivp9GBseGBMPnLiEDqIvMs8 EFuwhHkHWExY8nQTCYS6lMhL5BDcAqc6hhhNhbxdjyFqZPd1P2ah25bYEJPIK0c4vCAohgFU22F CjIFKCRgMZycaQNk= X-Received: by 2002:a5d:530f:: with SMTP id e15mr2473784wrv.51.1601364191345; Tue, 29 Sep 2020 00:23:11 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwwfN7S9CdOeW0yRVVqZyMhOntnqzkC1QEbVNbny+8Oz1mn4sZgjVlsQxHP7XCjZa9B1WsfCQ== X-Received: by 2002:a5d:530f:: with SMTP id e15mr2473764wrv.51.1601364191159; Tue, 29 Sep 2020 00:23:11 -0700 (PDT) Date: Tue, 29 Sep 2020 03:23:08 -0400 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Subject: [PULL v4 47/48] libvhost-user: return early on virtqueue errors Message-ID: <20200929071948.281157-48-mst@redhat.com> References: <20200929071948.281157-1-mst@redhat.com> MIME-Version: 1.0 In-Reply-To: <20200929071948.281157-1-mst@redhat.com> X-Mailer: git-send-email 2.27.0.106.g8ac3dc51b1 X-Mutt-Fcc: =sent Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=mst@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=63.128.21.124; envelope-from=mst@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/09/28 22:47:55 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.687, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , =?utf-8?Q?Marc-Andr=C3=A9?= Lureau , Philippe =?utf-8?Q?Mathieu-Daud=C3=A9?= , Stefan Hajnoczi , Raphael Norwitz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) From: Stefan Hajnoczi vu_panic() is not guaranteed to exit the program. Return early when errors are encountered. Note that libvhost-user does not have an "unmap" operation for mapped descriptors. Therefore it is correct to return without explicit cleanup. Signed-off-by: Stefan Hajnoczi Message-Id: <20200921113420.154378-2-stefanha@redhat.com> Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- contrib/libvhost-user/libvhost-user.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/contrib/libvhost-user/libvhost-user.c b/contrib/libvhost-user/= libvhost-user.c index 70055c98b7..4ebfa4cc40 100644 --- a/contrib/libvhost-user/libvhost-user.c +++ b/contrib/libvhost-user/libvhost-user.c @@ -2416,7 +2416,7 @@ vu_queue_set_notification(VuDev *dev, VuVirtq *vq, in= t enable) } } =20 -static void +static bool virtqueue_map_desc(VuDev *dev, unsigned int *p_num_sg, struct iovec *iov, unsigned int max_num_sg, bool is_write, @@ -2428,7 +2428,7 @@ virtqueue_map_desc(VuDev *dev, =20 if (!sz) { vu_panic(dev, "virtio: zero sized buffers are not allowed"); - return; + return false; } =20 while (sz) { @@ -2436,13 +2436,13 @@ virtqueue_map_desc(VuDev *dev, =20 if (num_sg =3D=3D max_num_sg) { vu_panic(dev, "virtio: too many descriptors in indirect table"= ); - return; + return false; } =20 iov[num_sg].iov_base =3D vu_gpa_to_va(dev, &len, pa); if (iov[num_sg].iov_base =3D=3D NULL) { vu_panic(dev, "virtio: invalid address for buffers"); - return; + return false; } iov[num_sg].iov_len =3D len; num_sg++; @@ -2451,6 +2451,7 @@ virtqueue_map_desc(VuDev *dev, } =20 *p_num_sg =3D num_sg; + return true; } =20 static void * @@ -2488,6 +2489,7 @@ vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned i= nt idx, size_t sz) if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_INDIRECT) { if (ldl_le_p(&desc[i].len) % sizeof(struct vring_desc)) { vu_panic(dev, "Invalid size for indirect buffer table"); + return NULL; } =20 /* loop over the indirect descriptor table */ @@ -2515,22 +2517,29 @@ vu_queue_map_desc(VuDev *dev, VuVirtq *vq, unsigned= int idx, size_t sz) /* Collect all the descriptors */ do { if (lduw_le_p(&desc[i].flags) & VRING_DESC_F_WRITE) { - virtqueue_map_desc(dev, &in_num, iov + out_num, + if (!virtqueue_map_desc(dev, &in_num, iov + out_num, VIRTQUEUE_MAX_SIZE - out_num, true, - ldq_le_p(&desc[i].addr), ldl_le_p(&desc[i].= len)); + ldq_le_p(&desc[i].addr), + ldl_le_p(&desc[i].len))) { + return NULL; + } } else { if (in_num) { vu_panic(dev, "Incorrect order for descriptors"); return NULL; } - virtqueue_map_desc(dev, &out_num, iov, + if (!virtqueue_map_desc(dev, &out_num, iov, VIRTQUEUE_MAX_SIZE, false, - ldq_le_p(&desc[i].addr), ldl_le_p(&desc[i].= len)); + ldq_le_p(&desc[i].addr), + ldl_le_p(&desc[i].len))) { + return NULL; + } } =20 /* If we've got too many, that implies a descriptor loop. */ if ((in_num + out_num) > max) { vu_panic(dev, "Looped descriptor"); + return NULL; } rc =3D virtqueue_read_next_desc(dev, desc, i, max, &i); } while (rc =3D=3D VIRTQUEUE_READ_DESC_MORE); --=20 MST