virtio: Clamp host-supplied used lengths
Needs ReviewPublic
Actions

Authored by kfv on Mon, Sep 28, 11:27 AM.

Tags

None

Referenced Files

	F173962405: D60092.id187872.diff
	Tue, Sep 29, 4:17 PM

	F173960269: D60092.diff
	Tue, Sep 29, 4:02 PM

	F173874529: D60092.id187872.diff
	Tue, Sep 29, 1:18 AM

	F173873207: D60092.diff
	Tue, Sep 29, 1:05 AM

	F173858742: D60092.id187872.diff
	Mon, Sep 28, 10:54 PM

	F173847965: D60092.diff
	Mon, Sep 28, 9:15 PM

Subscribers

None

Details

Reviewers

dteske
fuz
adrian
bryanv
imp
markj

Summary

Do not trust host-supplied used lengths; host could report
a used length larger than the buffer, causing the receive
and control paths to read past the buffer.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 77412
Build 74295: arc lint + arc unit

Event Timeline

kfv requested review of this revision.Mon, Sep 28, 11:27 AM

kfv created this revision.

Harbormaster completed remote builds in B77412: Diff 187872.Mon, Sep 28, 11:27 AM

This patch only updates virtio_console, but virtio_net has the same problem. Will you fix it too?

Revision Contents
Changeset List

Path

Size

sys/

dev/

virtio/

console/

virtio_console.c

2 lines

Diff 187872

View Options

sys/dev/virtio/console/virtio_console.c

virtio: Clamp host-supplied used lengthsNeeds ReviewPublicActions