Page MenuHomeFreeBSD
Differential D18465

Several iov handling bugs in bhyve virtio-scsi backend
ClosedPublic
Actions

Authored by mav on Dec 6 2018, 10:24 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Mar 17, 10:57 AM
Unknown Object (File)
Feb 28 2025, 5:36 PM
Unknown Object (File)
Feb 17 2025, 4:23 AM
Unknown Object (File)
Feb 17 2025, 2:03 AM
Unknown Object (File)
Feb 8 2025, 1:20 AM
Unknown Object (File)
Feb 1 2025, 10:53 PM
Unknown Object (File)
Jan 27 2025, 6:55 AM
Unknown Object (File)
Jan 26 2025, 3:02 PM
View All 56 Files
Subscribers
imp
wg

Details

Reviewers
araujo
rgrimes
Group Reviewers
bhyve
Commits
rS341705: Fix several iov handling bugs in bhyve virtio-scsi backend.
Summary
  • buf_to_iov() does not use buflen parameter, allowing out of bound read.
  • buf_to_iov() leaks memory if seek argument > 0.
  • iov_to_buf() doesn't need to reallocate buffer for every segment.
  • there is no point to use size_t for iov counts, int is more then enough.
  • some iov function arguments can be constified.
  • pci_vtscsi_request_handle() used truncate_iov() incorrectly, allowing getting out of buffer and possibly corrupting data.
  • pci_vtscsi_controlq_notify() written returned status at wrong offset.
  • pci_vtscsi_controlq_notify() leaked one buffer per event.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Revision Contents
Changeset List

PathSize
head/
usr.sbin/
bhyve/
13 lines
57 lines
10 lines

Diff 51737

View Options

head/usr.sbin/bhyve/iov.h

Show First 20 Lines • Show All 105 Lines • ▼ Show 20 Lines
*/ */
#define UMA_MD_SMALL_ALLOC #define UMA_MD_SMALL_ALLOC
#else /* Book-E */ #else /* Book-E */
#define KERNBASE 0xc0000000 /* start of kernel virtual */ #define KERNBASE 0xc0000000 /* start of kernel virtual */
#define VM_MIN_KERNEL_ADDRESS KERNBASE #define VM_MIN_KERNEL_ADDRESS KERNBASE
#define VM_MAX_KERNEL_ADDRESS 0xf7ffffff #define VM_MAX_KERNEL_ADDRESS 0xffffffff
#define VM_MAX_SAFE_KERNEL_ADDRESS VM_MAX_KERNEL_ADDRESS #define VM_MAX_SAFE_KERNEL_ADDRESS VM_MAX_KERNEL_ADDRESS
#endif /* AIM/E500 */ #endif /* AIM/E500 */
#if !defined(LOCORE) #if !defined(LOCORE)
struct pmap_physseg { struct pmap_physseg {
struct pv_entry *pvent; struct pv_entry *pvent;
char *attrs; char *attrs;
▲ Show 20 Lines • Show All 92 Lines • Show Last 20 Lines
View Options

head/usr.sbin/bhyve/iov.c

Show First 20 Lines • Show All 105 Lines • ▼ Show 20 Lines
*/ */
#define UMA_MD_SMALL_ALLOC #define UMA_MD_SMALL_ALLOC
#else /* Book-E */ #else /* Book-E */
#define KERNBASE 0xc0000000 /* start of kernel virtual */ #define KERNBASE 0xc0000000 /* start of kernel virtual */
#define VM_MIN_KERNEL_ADDRESS KERNBASE #define VM_MIN_KERNEL_ADDRESS KERNBASE
#define VM_MAX_KERNEL_ADDRESS 0xf7ffffff #define VM_MAX_KERNEL_ADDRESS 0xffffffff
#define VM_MAX_SAFE_KERNEL_ADDRESS VM_MAX_KERNEL_ADDRESS #define VM_MAX_SAFE_KERNEL_ADDRESS VM_MAX_KERNEL_ADDRESS
#endif /* AIM/E500 */ #endif /* AIM/E500 */
#if !defined(LOCORE) #if !defined(LOCORE)
struct pmap_physseg { struct pmap_physseg {
struct pv_entry *pvent; struct pv_entry *pvent;
char *attrs; char *attrs;
▲ Show 20 Lines • Show All 92 Lines • Show Last 20 Lines
View Options

head/usr.sbin/bhyve/pci_virtio_scsi.c

Show First 20 Lines • Show All 105 Lines • ▼ Show 20 Lines
*/ */
#define UMA_MD_SMALL_ALLOC #define UMA_MD_SMALL_ALLOC
#else /* Book-E */ #else /* Book-E */
#define KERNBASE 0xc0000000 /* start of kernel virtual */ #define KERNBASE 0xc0000000 /* start of kernel virtual */
#define VM_MIN_KERNEL_ADDRESS KERNBASE #define VM_MIN_KERNEL_ADDRESS KERNBASE
#define VM_MAX_KERNEL_ADDRESS 0xf7ffffff #define VM_MAX_KERNEL_ADDRESS 0xffffffff
#define VM_MAX_SAFE_KERNEL_ADDRESS VM_MAX_KERNEL_ADDRESS #define VM_MAX_SAFE_KERNEL_ADDRESS VM_MAX_KERNEL_ADDRESS
#endif /* AIM/E500 */ #endif /* AIM/E500 */
#if !defined(LOCORE) #if !defined(LOCORE)
struct pmap_physseg { struct pmap_physseg {
struct pv_entry *pvent; struct pv_entry *pvent;
char *attrs; char *attrs;
▲ Show 20 Lines • Show All 92 Lines • Show Last 20 Lines