Page MenuHomeFreeBSD
Differential D18465

Several iov handling bugs in bhyve virtio-scsi backend
ClosedPublic
Actions

Authored by mav on Dec 6 2018, 10:24 PM.
Tags
None
Referenced Files
F153414874: D18465.id.diff
Tue, Apr 21, 1:03 AM
Unknown Object (File)
Sun, Apr 19, 9:56 PM
Unknown Object (File)
Sun, Apr 19, 7:59 PM
Unknown Object (File)
Thu, Apr 9, 9:10 PM
Unknown Object (File)
Wed, Apr 8, 8:29 PM
Unknown Object (File)
Wed, Apr 8, 2:13 PM
Unknown Object (File)
Tue, Apr 7, 4:29 AM
Unknown Object (File)
Mon, Apr 6, 8:26 AM
View All Files
Subscribers
imp
wg

Details

Reviewers
araujo
rgrimes
Group Reviewers
bhyve
Commits
rS341705: Fix several iov handling bugs in bhyve virtio-scsi backend.
Summary
  • buf_to_iov() does not use buflen parameter, allowing out of bound read.
  • buf_to_iov() leaks memory if seek argument > 0.
  • iov_to_buf() doesn't need to reallocate buffer for every segment.
  • there is no point to use size_t for iov counts, int is more then enough.
  • some iov function arguments can be constified.
  • pci_vtscsi_request_handle() used truncate_iov() incorrectly, allowing getting out of buffer and possibly corrupting data.
  • pci_vtscsi_controlq_notify() written returned status at wrong offset.
  • pci_vtscsi_controlq_notify() leaked one buffer per event.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 21414

Revision Contents
Changeset List

PathSize
usr.sbin/
bhyve/
13 lines
59 lines
10 lines

Diff 51690

View Options

usr.sbin/bhyve/iov.h

Loading...
View Options

usr.sbin/bhyve/iov.c

Loading...
View Options

usr.sbin/bhyve/pci_virtio_scsi.c

Loading...