On (Fri) Dec 10 2010 [15:17:58], Paul Brook wrote:
On (Fri) Dec 10 2010 [13:59:50], Paul Brook wrote:
Check if the guest really sent any items in the out_vq before using
them. Similarly, check if there is a buffer to send data in before
writing.
Can this actually happen? If so why/how?
Why does it need a special case in this device?
A malicious guest (ie, a guest with the virtio_console module suitably
modified) could send in buffers with the 'input' bit set instead of
output as expected or vice-versa.
So what? Who cares if they get it wrong?
Just let the error_report() be there and continue as if nothing
happened?
It's entirely unclear whether this is actually an error. If a request has
zero
size then we just transfer zero bytes, exactly as requested.
Even if you accept this should be a diagnosable error, I suspect your patch
is
still insufficient. I don't see any code to check that input queue requests
have zero output segments, nor do I see anything to handle zero-length
segments.
virtio actually supports sending both, input as well as output types of
buffers in one go.
If this is guest triggerable then calling abort() is wrong.
It's either a guest bug or a malicious guest. What action is
recommended?
Killing the whole VM in response to a malformed request to a device is
clearly
a bug in that device. You should report an error to the guest in the normal
manner. IIRC virtio lacks any consistent error reporting mechanisms, and the
usual response when asked to do something impossible is to reset the device.
OK, agreed.
Amit
