d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bhyve: Fix vq_getchain() error handling bugs in various device models

Browse Source 
Reviewed by:	grehan, khng
Approved by:	so
Security:	CVE-2021-29631
Security:	FreeBSD-SA-21:13.bhyve
This commit is contained in:
Mark Johnston 2021-08-24 14:10:08 -04:00
parent aef815e787
commit 71fbc6faed
4 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
usr.sbin/bhyve/pci_virtio_9p.c
View File

@ -198,12 +198,13 @@ pci_vt9p_notify(void *vsc, struct vqueue_info *vq)
struct pci_vt9p_softc *sc;
struct pci_vt9p_request *preq;
struct vi_req req;
uint16_t n;
int n;
sc = vsc;
while (vq_has_descs(vq)) {
n = vq_getchain(vq, iov, VT9P_MAX_IOV, &req);
assert(n >= 1 && n <= VT9P_MAX_IOV);
preq = calloc(1, sizeof(struct pci_vt9p_request));
preq->vsr_sc = sc;
preq->vsr_idx = req.idx;

6
usr.sbin/bhyve/pci_virtio_console.c
View File

@ -442,6 +442,7 @@ pci_vtcon_sock_rx(int fd __unused, enum ev_type t __unused, void *arg)
do {
n = vq_getchain(vq, &iov, 1, &req);
assert(n == 1);
len = readv(sock->vss_conn_fd, &iov, n);
if (len == 0 || (len < 0 && errno == EWOULDBLOCK)) {
@ -582,7 +583,6 @@ pci_vtcon_control_send(struct pci_vtcon_softc *sc,
return;
n = vq_getchain(vq, &iov, 1, &req);
assert(n == 1);
memcpy(iov.iov_base, ctrl, sizeof(struct pci_vtcon_control));
@ -602,14 +602,14 @@ pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
struct pci_vtcon_port *port;
struct iovec iov[1];
struct vi_req req;
uint16_t n;
int n;
sc = vsc;
port = pci_vtcon_vq_to_port(sc, vq);
while (vq_has_descs(vq)) {
n = vq_getchain(vq, iov, 1, &req);
assert(n >= 1);
assert(n == 1);
if (port != NULL)
port->vsp_cb(port, port->vsp_arg, iov, 1);

5
usr.sbin/bhyve/pci_virtio_rnd.c
View File

@ -114,7 +114,7 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
struct iovec iov;
struct pci_vtrnd_softc *sc;
struct vi_req req;
int len;
int len, n;
sc = vsc;
@ -124,7 +124,8 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
}
while (vq_has_descs(vq)) {
vq_getchain(vq, &iov, 1, &req);
n = vq_getchain(vq, &iov, 1, &req);
assert(n == 1);
len = read(sc->vrsc_fd, iov.iov_base, iov.iov_len);

8
usr.sbin/bhyve/pci_virtio_scsi.c
View File

@ -559,15 +559,16 @@ pci_vtscsi_controlq_notify(void *vsc, struct vqueue_info *vq)
struct pci_vtscsi_softc *sc;
struct iovec iov[VTSCSI_MAXSEG];
struct vi_req req;
uint16_t n;
void *buf = NULL;
size_t bufsize;
int iolen;
int iolen, n;
sc = vsc;
while (vq_has_descs(vq)) {
n = vq_getchain(vq, iov, VTSCSI_MAXSEG, &req);
assert(n >= 1 && n <= VTSCSI_MAXSEG);
bufsize = iov_to_buf(iov, n, &buf);
iolen = pci_vtscsi_control_handle(sc, buf, bufsize);
buf_to_iov(buf + bufsize - iolen, iolen, iov, n,
@ -597,13 +598,14 @@ pci_vtscsi_requestq_notify(void *vsc, struct vqueue_info *vq)
struct pci_vtscsi_request *req;
struct iovec iov[VTSCSI_MAXSEG];
struct vi_req vireq;
uint16_t n;
int n;
sc = vsc;
q = &sc->vss_queues[vq->vq_num - 2];
while (vq_has_descs(vq)) {
n = vq_getchain(vq, iov, VTSCSI_MAXSEG, &vireq);
assert(n >= 1 && n <= VTSCSI_MAXSEG);
req = calloc(1, sizeof(struct pci_vtscsi_request));
req->vsr_idx = vireq.idx;