diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2021-04-13 18:56:54 +0200 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2021-04-30 12:27:48 +0200 |
| commit | 68bf7336533faa6aa90fdd4558edddbf5d8ef814 (patch) | |
| tree | c2d76ef5f92e0c520f28d1d1e3de263ae1c8599d /hw | |
| parent | 0b8fb55ce6398d7277b5ba0f19e39ec30a058191 (diff) | |
| download | qemu-68bf7336533faa6aa90fdd4558edddbf5d8ef814.zip | |
vhost-user-blk: Fail gracefully on too large queue size
virtio_add_queue() aborts when queue_size > VIRTQUEUE_MAX_SIZE, so
vhost_user_blk_device_realize() should check this before calling it.
Simple reproducer:
qemu-system-x86_64 \
-chardev null,id=foo \
-device vhost-user-blk-pci,queue-size=4096,chardev=foo
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1935014
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210413165654.50810-1-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/block/vhost-user-blk.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c index 0b5b9d44cd..f5e9682703 100644 --- a/hw/block/vhost-user-blk.c +++ b/hw/block/vhost-user-blk.c @@ -467,6 +467,11 @@ static void vhost_user_blk_device_realize(DeviceState *dev, Error **errp) error_setg(errp, "vhost-user-blk: queue size must be non-zero"); return; } + if (s->queue_size > VIRTQUEUE_MAX_SIZE) { + error_setg(errp, "vhost-user-blk: queue size must not exceed %d", + VIRTQUEUE_MAX_SIZE); + return; + } if (!vhost_user_init(&s->vhost_user, &s->chardev, errp)) { return; |