git: a7db88b5db58 - releng/11.4 - Fix missing error handling in bhyve(8) device models.
Gordon Tetlow
gordon at FreeBSD.org
Tue Aug 24 18:29:51 UTC 2021
The branch releng/11.4 has been updated by gordon:
URL: https://cgit.FreeBSD.org/src/commit/?id=a7db88b5db5817a806a38800c615b7755a3e6b34
commit a7db88b5db5817a806a38800c615b7755a3e6b34
Author: Gordon Tetlow <gordon at FreeBSD.org>
AuthorDate: 2021-08-24 17:34:59 +0000
Commit: Gordon Tetlow <gordon at FreeBSD.org>
CommitDate: 2021-08-24 17:34:59 +0000
Fix missing error handling in bhyve(8) device models.
Approved by: so
Security: SA-21:13.bhyve
Security: CVE-2021-29631
---
usr.sbin/bhyve/pci_virtio_console.c | 7 ++++---
usr.sbin/bhyve/pci_virtio_rnd.c | 5 +++--
2 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/usr.sbin/bhyve/pci_virtio_console.c b/usr.sbin/bhyve/pci_virtio_console.c
index 13aa4ad30cca..73528a2e1476 100644
--- a/usr.sbin/bhyve/pci_virtio_console.c
+++ b/usr.sbin/bhyve/pci_virtio_console.c
@@ -404,6 +404,7 @@ pci_vtcon_sock_rx(int fd __unused, enum ev_type t __unused, void *arg)
do {
n = vq_getchain(vq, &idx, &iov, 1, NULL);
+ assert(n == 1);
len = readv(sock->vss_conn_fd, &iov, n);
if (len == 0 || (len < 0 && errno == EWOULDBLOCK)) {
@@ -544,7 +545,6 @@ pci_vtcon_control_send(struct pci_vtcon_softc *sc,
return;
n = vq_getchain(vq, &idx, &iov, 1, NULL);
-
assert(n == 1);
memcpy(iov.iov_base, ctrl, sizeof(struct pci_vtcon_control));
@@ -563,7 +563,8 @@ pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
struct pci_vtcon_softc *sc;
struct pci_vtcon_port *port;
struct iovec iov[1];
- uint16_t idx, n;
+ int n;
+ uint16_t idx;
uint16_t flags[8];
sc = vsc;
@@ -571,7 +572,7 @@ pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
while (vq_has_descs(vq)) {
n = vq_getchain(vq, &idx, iov, 1, flags);
- assert(n >= 1);
+ assert(n == 1);
if (port != NULL)
port->vsp_cb(port, port->vsp_arg, iov, 1);
diff --git a/usr.sbin/bhyve/pci_virtio_rnd.c b/usr.sbin/bhyve/pci_virtio_rnd.c
index 44bc55e0039e..5d2fac0c723a 100644
--- a/usr.sbin/bhyve/pci_virtio_rnd.c
+++ b/usr.sbin/bhyve/pci_virtio_rnd.c
@@ -109,7 +109,7 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
{
struct iovec iov;
struct pci_vtrnd_softc *sc;
- int len;
+ int len, n;
uint16_t idx;
sc = vsc;
@@ -120,7 +120,8 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
}
while (vq_has_descs(vq)) {
- vq_getchain(vq, &idx, &iov, 1, NULL);
+ n = vq_getchain(vq, &idx, &iov, 1, NULL);
+ assert(n == 1);
len = read(sc->vrsc_fd, iov.iov_base, iov.iov_len);
More information about the dev-commits-src-branches
mailing list