Differential D18465

Several iov handling bugs in bhyve virtio-scsi backend
ClosedPublic
Actions

Authored by mav on Dec 6 2018, 10:24 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Sat, Apr 27, 1:26 AM

	Unknown Object (File)
	Sat, Apr 27, 1:18 AM

	Unknown Object (File)
	Fri, Apr 26, 10:17 PM

	Unknown Object (File)
	Fri, Apr 26, 9:53 PM

	Unknown Object (File)
	Fri, Apr 26, 12:01 PM

	Unknown Object (File)
	Fri, Apr 26, 11:50 AM

	Unknown Object (File)
	Fri, Apr 26, 10:21 AM

	Unknown Object (File)
	Fri, Apr 26, 7:11 AM

View All 20 Files

Subscribers

Details

Reviewers

araujo
rgrimes

Group Reviewers

Commits

rS341705: Fix several iov handling bugs in bhyve virtio-scsi backend.

Summary

buf_to_iov() does not use buflen parameter, allowing out of bound read.
buf_to_iov() leaks memory if seek argument > 0.
iov_to_buf() doesn't need to reallocate buffer for every segment.
there is no point to use size_t for iov counts, int is more then enough.
some iov function arguments can be constified.
pci_vtscsi_request_handle() used truncate_iov() incorrectly, allowing getting out of buffer and possibly corrupting data.
pci_vtscsi_controlq_notify() written returned status at wrong offset.
pci_vtscsi_controlq_notify() leaked one buffer per event.

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 21414

Event Timeline

mav created this revision.Dec 6 2018, 10:24 PM

Herald added a reviewer: rgrimes. · View Herald TranscriptDec 6 2018, 10:24 PM

Herald added a subscriber: imp. · View Herald Transcript

Harbormaster completed remote builds in B21414: Diff 51690.Dec 6 2018, 10:24 PM

araujo edited reviewers, added: bhyve; removed: wg.Dec 7 2018, 4:59 AM

araujo added a subscriber: wg.

mav edited the summary of this revision. (Show Details)Dec 7 2018, 2:48 PM

Lgtm!

This revision is now accepted and ready to land.Dec 7 2018, 7:25 PM

Closed by commit rS341705: Fix several iov handling bugs in bhyve virtio-scsi backend. (authored by mav). · Explain WhyDec 7 2018, 8:31 PM

This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

Path

Size

usr.sbin/

bhyve/

13 lines

59 lines

pci_virtio_scsi.c

10 lines

Diff 51690

usr.sbin/bhyve/iov.h

Loading...

usr.sbin/bhyve/iov.c

Loading...

usr.sbin/bhyve/pci_virtio_scsi.c

Loading...