xemu-project/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2024-11-24 03:59:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

vhost-user: fix misaligned access to payload

Browse Source 
We currently take a pointer to a misaligned field of a packed structure.
clang reports this as a build warning.
A fix is to keep payload in a separate structure, and access is it
from there using a vectored write.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Michael S. Tsirkin 2018-01-08 19:47:11 +02:00
parent 24e34754eb
commit 69aff03064
1 changed files with 24 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
hw/virtio/vhost-user.c
View File

@ -652,33 +652,34 @@ static void slave_read(void *opaque)
{
struct vhost_dev *dev = opaque;
struct vhost_user *u = dev->opaque;
VhostUserMsg msg = { 0, };
VhostUserHeader hdr = { 0, };
VhostUserPayload payload = { 0, };
int size, ret = 0;
/* Read header */
size = read(u->slave_fd, &msg, VHOST_USER_HDR_SIZE);
size = read(u->slave_fd, &hdr, VHOST_USER_HDR_SIZE);
if (size != VHOST_USER_HDR_SIZE) {
error_report("Failed to read from slave.");
goto err;
}
if (msg.hdr.size > VHOST_USER_PAYLOAD_SIZE) {
if (hdr.size > VHOST_USER_PAYLOAD_SIZE) {
error_report("Failed to read msg header."
" Size %d exceeds the maximum %zu.", msg.hdr.size,
" Size %d exceeds the maximum %zu.", hdr.size,
VHOST_USER_PAYLOAD_SIZE);
goto err;
}
/* Read payload */
size = read(u->slave_fd, &msg.payload, msg.hdr.size);
if (size != msg.hdr.size) {
size = read(u->slave_fd, &payload, hdr.size);
if (size != hdr.size) {
error_report("Failed to read payload from slave.");
goto err;
}
switch (msg.hdr.request) {
switch (hdr.request) {
case VHOST_USER_SLAVE_IOTLB_MSG:
ret = vhost_backend_handle_iotlb_msg(dev, &msg.payload.iotlb);
ret = vhost_backend_handle_iotlb_msg(dev, &payload.iotlb);
break;
case VHOST_USER_SLAVE_CONFIG_CHANGE_MSG :
ret = vhost_user_slave_handle_config_change(dev);
@ -692,15 +693,23 @@ static void slave_read(void *opaque)
* REPLY_ACK feature handling. Other reply types has to be managed
* directly in their request handlers.
*/
if (msg.hdr.flags & VHOST_USER_NEED_REPLY_MASK) {
msg.hdr.flags &= ~VHOST_USER_NEED_REPLY_MASK;
msg.hdr.flags |= VHOST_USER_REPLY_MASK;
if (hdr.flags & VHOST_USER_NEED_REPLY_MASK) {
struct iovec iovec[2];
msg.payload.u64 = !!ret;
msg.hdr.size = sizeof(msg.payload.u64);
size = write(u->slave_fd, &msg, VHOST_USER_HDR_SIZE + msg.hdr.size);
if (size != VHOST_USER_HDR_SIZE + msg.hdr.size) {
hdr.flags &= ~VHOST_USER_NEED_REPLY_MASK;
hdr.flags |= VHOST_USER_REPLY_MASK;
payload.u64 = !!ret;
hdr.size = sizeof(payload.u64);
iovec[0].iov_base = &hdr;
iovec[0].iov_len = VHOST_USER_HDR_SIZE;
iovec[1].iov_base = &payload;
iovec[1].iov_len = hdr.size;
size = writev(u->slave_fd, iovec, ARRAY_SIZE(iovec));
if (size != VHOST_USER_HDR_SIZE + hdr.size) {
error_report("Failed to send msg reply to slave.");
goto err;
}