Fix missing error handling in bhyve(8) device models.
Approved by: so Security: SA-21:13.bhyve Security: CVE-2021-29631
This commit is contained in:
parent
3903650ce0
commit
d93d96c88f
|
@ -417,6 +417,7 @@ pci_vtcon_sock_rx(int fd __unused, enum ev_type t __unused, void *arg)
|
|||
|
||||
do {
|
||||
n = vq_getchain(vq, &idx, &iov, 1, NULL);
|
||||
assert(n == 1);
|
||||
len = readv(sock->vss_conn_fd, &iov, n);
|
||||
|
||||
if (len == 0 || (len < 0 && errno == EWOULDBLOCK)) {
|
||||
|
@ -557,7 +558,6 @@ pci_vtcon_control_send(struct pci_vtcon_softc *sc,
|
|||
return;
|
||||
|
||||
n = vq_getchain(vq, &idx, &iov, 1, NULL);
|
||||
|
||||
assert(n == 1);
|
||||
|
||||
memcpy(iov.iov_base, ctrl, sizeof(struct pci_vtcon_control));
|
||||
|
@ -576,7 +576,8 @@ pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
|
|||
struct pci_vtcon_softc *sc;
|
||||
struct pci_vtcon_port *port;
|
||||
struct iovec iov[1];
|
||||
uint16_t idx, n;
|
||||
int n;
|
||||
uint16_t idx;
|
||||
uint16_t flags[8];
|
||||
|
||||
sc = vsc;
|
||||
|
@ -584,7 +585,7 @@ pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
|
|||
|
||||
while (vq_has_descs(vq)) {
|
||||
n = vq_getchain(vq, &idx, iov, 1, flags);
|
||||
assert(n >= 1);
|
||||
assert(n == 1);
|
||||
if (port != NULL)
|
||||
port->vsp_cb(port, port->vsp_arg, iov, 1);
|
||||
|
||||
|
|
|
@ -112,7 +112,7 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
|
|||
{
|
||||
struct iovec iov;
|
||||
struct pci_vtrnd_softc *sc;
|
||||
int len;
|
||||
int len, n;
|
||||
uint16_t idx;
|
||||
|
||||
sc = vsc;
|
||||
|
@ -123,7 +123,8 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
|
|||
}
|
||||
|
||||
while (vq_has_descs(vq)) {
|
||||
vq_getchain(vq, &idx, &iov, 1, NULL);
|
||||
n = vq_getchain(vq, &idx, &iov, 1, NULL);
|
||||
assert(n == 1);
|
||||
|
||||
len = read(sc->vrsc_fd, iov.iov_base, iov.iov_len);
|
||||
|
||||
|
|
|
@ -555,15 +555,16 @@ pci_vtscsi_controlq_notify(void *vsc, struct vqueue_info *vq)
|
|||
{
|
||||
struct pci_vtscsi_softc *sc;
|
||||
struct iovec iov[VTSCSI_MAXSEG];
|
||||
uint16_t idx, n;
|
||||
uint16_t idx;
|
||||
void *buf = NULL;
|
||||
size_t bufsize;
|
||||
int iolen;
|
||||
int iolen, n;
|
||||
|
||||
sc = vsc;
|
||||
|
||||
while (vq_has_descs(vq)) {
|
||||
n = vq_getchain(vq, &idx, iov, VTSCSI_MAXSEG, NULL);
|
||||
assert(n >= 1 && n <= VTSCSI_MAXSEG);
|
||||
bufsize = iov_to_buf(iov, n, &buf);
|
||||
iolen = pci_vtscsi_control_handle(sc, buf, bufsize);
|
||||
buf_to_iov(buf + bufsize - iolen, iolen, iov, n,
|
||||
|
@ -593,8 +594,8 @@ pci_vtscsi_requestq_notify(void *vsc, struct vqueue_info *vq)
|
|||
struct pci_vtscsi_request *req;
|
||||
struct iovec iov[VTSCSI_MAXSEG];
|
||||
uint16_t flags[VTSCSI_MAXSEG];
|
||||
uint16_t idx, n, i;
|
||||
int readable;
|
||||
uint16_t idx, i;
|
||||
int readable, n;
|
||||
|
||||
sc = vsc;
|
||||
q = &sc->vss_queues[vq->vq_num - 2];
|
||||
|
@ -602,6 +603,7 @@ pci_vtscsi_requestq_notify(void *vsc, struct vqueue_info *vq)
|
|||
while (vq_has_descs(vq)) {
|
||||
readable = 0;
|
||||
n = vq_getchain(vq, &idx, iov, VTSCSI_MAXSEG, flags);
|
||||
assert(n >= 1 && n <= VTSCSI_MAXSEG);
|
||||
|
||||
/* Count readable descriptors */
|
||||
for (i = 0; i < n; i++) {
|
||||
|
|
Loading…
Reference in New Issue