On Tue, Jul 16, 2019 at 03:38:00AM +0000, Oleinik, Alexander wrote: > While fuzzing the virtio-net tx vq, I ran into an assertion failure due > to iov_copy offsets larger than the total iov size. Though there is > a check to cover this, it does not execute when !n->has_vnet_hdr. This > patch tries to fix this. > > The call stack for the assertion failure: > > #8 in __assert_fail (libc.so.6+0x300f1) > #9 in iov_copy iov.c:266:5 > #10 in virtio_net_flush_tx virtio-net.c:2073:23 > #11 in virtio_net_tx_bh virtio-net.c:2197:11 > #12 in aio_bh_poll async.c:118:13 > #13 in aio_dispatch aio-posix.c:460:5 > #14 in aio_ctx_dispatch async.c:261:5 > #15 in g_main_context_dispatch (libglib-2.0.so.0+0x4df2d) > #16 in glib_pollfds_poll main-loop.c:213:9 > #17 in os_host_main_loop_wait main-loop.c:236 > #18 in main_loop_wait main-loop.c:512 > #19 in virtio_net_tx_fuzz virtio-net-fuzz.c:160:3 > > Thanks > -Alex
I think I'd rather introduce a variant of iov_copy that returns the remaining offset. the code that duplicates this for byte-swap seems to also have this problem. > Alexander Oleinik (1): > virtio-net: check guest header length is valid > > hw/net/virtio-net.c | 13 ++++++++++++- > 1 file changed, 12 insertions(+), 1 deletion(-) > > -- > 2.20.1
