jimzah/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2024-11-30 04:22:44 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Fix missing error handling in bhyve(8) device models.

Browse Source 
Approved by:    so
Security:       SA-21:13.bhyve
Security:       CVE-2021-29631
This commit is contained in:
Gordon Tetlow 2021-08-24 10:34:59 -07:00
parent 7fe589000c
commit a7db88b5db
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
usr.sbin/bhyve/pci_virtio_console.c
View File

@ -404,6 +404,7 @@ pci_vtcon_sock_rx(int fd __unused, enum ev_type t __unused, void *arg)
do {
n = vq_getchain(vq, &idx, &iov, 1, NULL);
assert(n == 1);
len = readv(sock->vss_conn_fd, &iov, n);
if (len == 0 || (len < 0 && errno == EWOULDBLOCK)) {
@ -544,7 +545,6 @@ pci_vtcon_control_send(struct pci_vtcon_softc *sc,
return;
n = vq_getchain(vq, &idx, &iov, 1, NULL);
assert(n == 1);
memcpy(iov.iov_base, ctrl, sizeof(struct pci_vtcon_control));
@ -563,7 +563,8 @@ pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
struct pci_vtcon_softc *sc;
struct pci_vtcon_port *port;
struct iovec iov[1];
uint16_t idx, n;
int n;
uint16_t idx;
uint16_t flags[8];
sc = vsc;
@ -571,7 +572,7 @@ pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
while (vq_has_descs(vq)) {
n = vq_getchain(vq, &idx, iov, 1, flags);
assert(n >= 1);
assert(n == 1);
if (port != NULL)
port->vsp_cb(port, port->vsp_arg, iov, 1);

5
usr.sbin/bhyve/pci_virtio_rnd.c
View File

@ -109,7 +109,7 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
{
struct iovec iov;
struct pci_vtrnd_softc *sc;
int len;
int len, n;
uint16_t idx;
sc = vsc;
@ -120,7 +120,8 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
}
while (vq_has_descs(vq)) {
vq_getchain(vq, &idx, &iov, 1, NULL);
n = vq_getchain(vq, &idx, &iov, 1, NULL);
assert(n == 1);
len = read(sc->vrsc_fd, iov.iov_base, iov.iov_len);