71 lines
2.7 KiB
Diff
71 lines
2.7 KiB
Diff
From 03aeb30096eb0d48e0b493ed4925b99b0e27979e Mon Sep 17 00:00:00 2001
|
|
From: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Date: Mon, 15 Mar 2021 18:16:29 -0400
|
|
Subject: [PATCH 13/15] block/export: port virtio-blk read/write range check
|
|
|
|
RH-Author: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Message-id: <20210315181629.212884-7-stefanha@redhat.com>
|
|
Patchwork-id: 101343
|
|
O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 6/6] block/export: port virtio-blk read/write range check
|
|
Bugzilla: 1937004
|
|
RH-Acked-by: Danilo de Paula <ddepaula@redhat.com>
|
|
RH-Acked-by: Kevin Wolf <kwolf@redhat.com>
|
|
RH-Acked-by: Max Reitz <mreitz@redhat.com>
|
|
|
|
Check that the sector number and byte count are valid.
|
|
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Message-Id: <20210223144653.811468-13-stefanha@redhat.com>
|
|
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
(cherry picked from commit 05ae4e674e3d47342a7660ae7bc55b393e09f4c7)
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
|
|
---
|
|
block/export/vhost-user-blk-server.c | 19 ++++++++++++++++---
|
|
1 file changed, 16 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
|
|
index 937bb5e9b4..dbe3cfb9e8 100644
|
|
--- a/block/export/vhost-user-blk-server.c
|
|
+++ b/block/export/vhost-user-blk-server.c
|
|
@@ -209,6 +209,8 @@ static void coroutine_fn vu_blk_virtio_process_req(void *opaque)
|
|
switch (type & ~VIRTIO_BLK_T_BARRIER) {
|
|
case VIRTIO_BLK_T_IN:
|
|
case VIRTIO_BLK_T_OUT: {
|
|
+ QEMUIOVector qiov;
|
|
+ int64_t offset;
|
|
ssize_t ret = 0;
|
|
bool is_write = type & VIRTIO_BLK_T_OUT;
|
|
req->sector_num = le64_to_cpu(req->out.sector);
|
|
@@ -218,13 +220,24 @@ static void coroutine_fn vu_blk_virtio_process_req(void *opaque)
|
|
break;
|
|
}
|
|
|
|
- int64_t offset = req->sector_num << VIRTIO_BLK_SECTOR_BITS;
|
|
- QEMUIOVector qiov;
|
|
if (is_write) {
|
|
qemu_iovec_init_external(&qiov, out_iov, out_num);
|
|
- ret = blk_co_pwritev(blk, offset, qiov.size, &qiov, 0);
|
|
} else {
|
|
qemu_iovec_init_external(&qiov, in_iov, in_num);
|
|
+ }
|
|
+
|
|
+ if (unlikely(!vu_blk_sect_range_ok(vexp,
|
|
+ req->sector_num,
|
|
+ qiov.size))) {
|
|
+ req->in->status = VIRTIO_BLK_S_IOERR;
|
|
+ break;
|
|
+ }
|
|
+
|
|
+ offset = req->sector_num << VIRTIO_BLK_SECTOR_BITS;
|
|
+
|
|
+ if (is_write) {
|
|
+ ret = blk_co_pwritev(blk, offset, qiov.size, &qiov, 0);
|
|
+ } else {
|
|
ret = blk_co_preadv(blk, offset, qiov.size, &qiov, 0);
|
|
}
|
|
if (ret >= 0) {
|
|
--
|
|
2.27.0
|
|
|