[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 09/12] kvm-all: introduce limits for name_size and num_desc
From: |
Vladimir Sementsov-Ogievskiy |
Subject: |
[PATCH 09/12] kvm-all: introduce limits for name_size and num_desc |
Date: |
Mon, 25 Sep 2023 22:40:37 +0300 |
Coverity doesn't like when the value with unchecked bounds that comes
from fd is used as length for IO or allocation. And really, that's not
a good practice. Let's introduce at least an empirical limits for these
values.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
---
accel/kvm/kvm-all.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index ff1578bb32..6d0ba7d900 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3988,6 +3988,9 @@ typedef struct StatsDescriptors {
static QTAILQ_HEAD(, StatsDescriptors) stats_descriptors =
QTAILQ_HEAD_INITIALIZER(stats_descriptors);
+
+#define KVM_STATS_QEMU_MAX_NAME_SIZE (1024 * 1024)
+#define KVM_STATS_QEMU_MAX_NUM_DESC (1024)
/*
* Return the descriptors for 'target', that either have already been read
* or are retrieved from 'stats_fd'.
@@ -4021,6 +4024,18 @@ static StatsDescriptors
*find_stats_descriptors(StatsTarget target, int stats_fd
g_free(descriptors);
return NULL;
}
+ if (kvm_stats_header->name_size > KVM_STATS_QEMU_MAX_NAME_SIZE) {
+ error_setg(errp, "KVM stats: too large name_size: %" PRIu32,
+ kvm_stats_header->name_size);
+ g_free(descriptors);
+ return NULL;
+ }
+ if (kvm_stats_header->num_desc > KVM_STATS_QEMU_MAX_NUM_DESC) {
+ error_setg(errp, "KVM stats: too large num_desc: %" PRIu32,
+ kvm_stats_header->num_desc);
+ g_free(descriptors);
+ return NULL;
+ }
size_desc = sizeof(*kvm_stats_desc) + kvm_stats_header->name_size;
/* Read stats descriptors */
--
2.34.1
- [PATCH 07/12] pcie_sriov: unregister_vfs(): fix error path, (continued)