Fix missing error handling in bhyve(8) device models.

Approved by:	so
Security:	SA-21:13.bhyve
Security:	CVE-2021-29631
This commit is contained in:
Gordon Tetlow 2021-08-24 10:34:36 -07:00 committed by Franco Fichtner
parent 3903650ce0
commit d93d96c88f
3 changed files with 13 additions and 9 deletions

View File

@ -417,6 +417,7 @@ pci_vtcon_sock_rx(int fd __unused, enum ev_type t __unused, void *arg)
do {
n = vq_getchain(vq, &idx, &iov, 1, NULL);
assert(n == 1);
len = readv(sock->vss_conn_fd, &iov, n);
if (len == 0 || (len < 0 && errno == EWOULDBLOCK)) {
@ -557,7 +558,6 @@ pci_vtcon_control_send(struct pci_vtcon_softc *sc,
return;
n = vq_getchain(vq, &idx, &iov, 1, NULL);
assert(n == 1);
memcpy(iov.iov_base, ctrl, sizeof(struct pci_vtcon_control));
@ -576,7 +576,8 @@ pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
struct pci_vtcon_softc *sc;
struct pci_vtcon_port *port;
struct iovec iov[1];
uint16_t idx, n;
int n;
uint16_t idx;
uint16_t flags[8];
sc = vsc;
@ -584,7 +585,7 @@ pci_vtcon_notify_tx(void *vsc, struct vqueue_info *vq)
while (vq_has_descs(vq)) {
n = vq_getchain(vq, &idx, iov, 1, flags);
assert(n >= 1);
assert(n == 1);
if (port != NULL)
port->vsp_cb(port, port->vsp_arg, iov, 1);

View File

@ -112,7 +112,7 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
{
struct iovec iov;
struct pci_vtrnd_softc *sc;
int len;
int len, n;
uint16_t idx;
sc = vsc;
@ -123,7 +123,8 @@ pci_vtrnd_notify(void *vsc, struct vqueue_info *vq)
}
while (vq_has_descs(vq)) {
vq_getchain(vq, &idx, &iov, 1, NULL);
n = vq_getchain(vq, &idx, &iov, 1, NULL);
assert(n == 1);
len = read(sc->vrsc_fd, iov.iov_base, iov.iov_len);

View File

@ -555,15 +555,16 @@ pci_vtscsi_controlq_notify(void *vsc, struct vqueue_info *vq)
{
struct pci_vtscsi_softc *sc;
struct iovec iov[VTSCSI_MAXSEG];
uint16_t idx, n;
uint16_t idx;
void *buf = NULL;
size_t bufsize;
int iolen;
int iolen, n;
sc = vsc;
while (vq_has_descs(vq)) {
n = vq_getchain(vq, &idx, iov, VTSCSI_MAXSEG, NULL);
assert(n >= 1 && n <= VTSCSI_MAXSEG);
bufsize = iov_to_buf(iov, n, &buf);
iolen = pci_vtscsi_control_handle(sc, buf, bufsize);
buf_to_iov(buf + bufsize - iolen, iolen, iov, n,
@ -593,8 +594,8 @@ pci_vtscsi_requestq_notify(void *vsc, struct vqueue_info *vq)
struct pci_vtscsi_request *req;
struct iovec iov[VTSCSI_MAXSEG];
uint16_t flags[VTSCSI_MAXSEG];
uint16_t idx, n, i;
int readable;
uint16_t idx, i;
int readable, n;
sc = vsc;
q = &sc->vss_queues[vq->vq_num - 2];
@ -602,6 +603,7 @@ pci_vtscsi_requestq_notify(void *vsc, struct vqueue_info *vq)
while (vq_has_descs(vq)) {
readable = 0;
n = vq_getchain(vq, &idx, iov, VTSCSI_MAXSEG, flags);
assert(n >= 1 && n <= VTSCSI_MAXSEG);
/* Count readable descriptors */
for (i = 0; i < n; i++) {