[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-7.2.11 53/59] backends/cryptodev: Do not abort for invalid sessi
From: |
Michael Tokarev |
Subject: |
[Stable-7.2.11 53/59] backends/cryptodev: Do not abort for invalid session ID |
Date: |
Thu, 18 Apr 2024 23:02:13 +0300 |
From: Philippe Mathieu-Daudé <philmd@linaro.org>
Instead of aborting when a session ID is invalid,
return VIRTIO_CRYPTO_INVSESS ("Invalid session id").
Reproduced using:
$ cat << EOF | qemu-system-i386 -display none \
-machine q35,accel=qtest -m 512M -nodefaults \
-object cryptodev-backend-builtin,id=cryptodev0 \
-device virtio-crypto-pci,id=crypto0,cryptodev=cryptodev0 \
-qtest stdio
outl 0xcf8 0x80000804
outw 0xcfc 0x06
outl 0xcf8 0x80000820
outl 0xcfc 0xe0008000
write 0x10800e 0x1 0x01
write 0xe0008016 0x1 0x01
write 0xe0008020 0x4 0x00801000
write 0xe0008028 0x4 0x00c01000
write 0xe000801c 0x1 0x01
write 0x110000 0x1 0x05
write 0x110001 0x1 0x04
write 0x108002 0x1 0x11
write 0x108008 0x1 0x48
write 0x10800c 0x1 0x01
write 0x108018 0x1 0x10
write 0x10801c 0x1 0x02
write 0x10c002 0x1 0x01
write 0xe000b005 0x1 0x00
EOF
Assertion failed: (session_id < MAX_NUM_SESSIONS &&
builtin->sessions[session_id]),
function cryptodev_builtin_close_session, file cryptodev-builtin.c, line 430.
Cc: qemu-stable@nongnu.org
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2274
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: zhenwei pi <pizhenwei@bytedance.com>
Message-Id: <20240409094757.9127-1-philmd@linaro.org>
(cherry picked from commit eaf2bd29538d039df80bb4b1584de33a61312bc6)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/backends/cryptodev-builtin.c b/backends/cryptodev-builtin.c
index cda6ca3b71..2e792be756 100644
--- a/backends/cryptodev-builtin.c
+++ b/backends/cryptodev-builtin.c
@@ -416,7 +416,9 @@ static int cryptodev_builtin_close_session(
CRYPTODEV_BACKEND_BUILTIN(backend);
CryptoDevBackendBuiltinSession *session;
- assert(session_id < MAX_NUM_SESSIONS && builtin->sessions[session_id]);
+ if (session_id >= MAX_NUM_SESSIONS || !builtin->sessions[session_id]) {
+ return -VIRTIO_CRYPTO_INVSESS;
+ }
session = builtin->sessions[session_id];
if (session->cipher) {
--
2.39.2
- [Stable-7.2.11 v2 00/59] Patch Round-up for stable 7.2.11, freeze on 2024-04-20, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 42/59] tcg/optimize: Do not attempt to constant fold neg_vec, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 46/59] hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 43/59] linux-user: Fix waitid return of siginfo_t and rusage, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 44/59] hw/virtio: Introduce virtio_bh_new_guarded() helper, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 50/59] hw/block/nand: Have blk_load() take unsigned offset and return boolean, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 53/59] backends/cryptodev: Do not abort for invalid session ID,
Michael Tokarev <=
- [Stable-7.2.11 48/59] qemu-options: Fix CXL Fixed Memory Window interleave-granularity typo, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 45/59] hw/display/virtio-gpu: Protect from DMA re-entrancy bugs, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 47/59] hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 51/59] hw/block/nand: Fix out-of-bound access in NAND block buffer, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 52/59] hw/misc/applesmc: Fix memory leak in reset() handler, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 49/59] hw/block/nand: Factor nand_load_iolen() method out, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 54/59] hw/net/lan9118: Fix overflow in MIL TX FIFO, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 56/59] hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 55/59] hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition, Michael Tokarev, 2024/04/18
- [Stable-7.2.11 57/59] target/sh4: add missing CHECK_NOT_DELAY_SLOT, Michael Tokarev, 2024/04/18