From f8ffcb2bda22bad8e91da70c28ec52724a054f92 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Tue, 27 Oct 2020 17:35:20 +0000 Subject: [PATCH] block/export: fix vhost-user-blk get_config() information leak Refuse get_config() requests in excess of sizeof(struct virtio_blk_config). Signed-off-by: Stefan Hajnoczi Message-Id: <20201027173528.213464-5-stefanha@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- block/export/vhost-user-blk-server.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c index 33cc0818b8..62672d1cb9 100644 --- a/block/export/vhost-user-blk-server.c +++ b/block/export/vhost-user-blk-server.c @@ -266,6 +266,9 @@ vu_blk_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len) { VuServer *server = container_of(vu_dev, VuServer, vu_dev); VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server); + + g_return_val_if_fail(len <= sizeof(struct virtio_blk_config), -1); + memcpy(config, &vexp->blkcfg, len); return 0; }