From: Marc-André Lureau <marcandre.lur...@redhat.com>
The number of eventfd that can be handled per peer is limited by the
number of vectors. Return an error when receiving too many of them.
Signed-off-by: Marc-André Lureau <marcandre.lur...@redhat.com>
Reviewed-by: Claudio Fontana <claudio.font...@huawei.com>
---
hw/misc/ivshmem.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index 0e31d1d..50af4c7 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -571,6 +571,14 @@ static void ivshmem_read(void *opaque, const uint8_t *buf,
int size)
/* each peer has an associated array of eventfds, and we keep
* track of how many eventfds received so far */
/* get a new eventfd: */
+ /* get a new eventfd */
+ if (peer->nb_eventfds >= s->vectors) {
+ error_report("Too many eventfd received, device has %d vectors",
+ s->vectors);
+ close(incoming_fd);
+ return;
+ }
+
new_eventfd = peer->nb_eventfds++;
/* this is an eventfd for a particular peer VM */
--
2.4.3
