diff mbox series

[PULL,10/12] io/channel-socket: qio_channel_socket_flush(): improve msg validation

Message ID 20231106153238.1426649-11-peter.maydell@linaro.org
State Accepted
Commit 35bafa95da671f5a902e87fcc301f76f82cd0831
Headers show
Series [PULL,01/12] hw/arm/virt: fix PMU IRQ registration | expand

Commit Message

Peter Maydell Nov. 6, 2023, 3:32 p.m. UTC 
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>

For SO_EE_ORIGIN_ZEROCOPY the 32-bit notification range is encoded
as [ee_info, ee_data] inclusively, so ee_info should be less or
equal to ee_data.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
Message-id: 20231017125941.810461-7-vsementsov@yandex-team.ru
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 io/channel-socket.c | 5 +++++
 1 file changed, 5 insertions(+)
diff mbox series

Patch

diff --git a/io/channel-socket.c b/io/channel-socket.c
index 02ffb51e995..3a899b06085 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -782,6 +782,11 @@  static int qio_channel_socket_flush(QIOChannel *ioc,
                              "Error not from zero copy");
             return -1;
         }
+        if (serr->ee_data < serr->ee_info) {
+            error_setg_errno(errp, serr->ee_origin,
+                             "Wrong notification bounds");
+            return -1;
+        }
 
         /* No errors, count successfully finished sendmsg()*/
         sioc->zero_copy_sent += serr->ee_data - serr->ee_info + 1;