Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 635535 - Disallow 0-sized writes to virtio ports to go through to host (leading to VM crash)
Disallow 0-sized writes to virtio ports to go through to host (leading to VM ...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: kernel (Show other bugs)
6.1
All Linux
medium Severity high
: rc
: 6.1
Assigned To: Amit Shah
Virtualization Bugs
: ZStream
Depends On:
Blocks: 580954 636046 678559
  Show dependency treegraph
 
Reported: 2010-09-20 02:05 EDT by Amit Shah
Modified: 2013-01-10 22:20 EST (History)
9 users (show)

See Also:
Fixed In Version: kernel-2.6.32-85.el6
Doc Type: Bug Fix
Doc Text:
Prior to this update, user space could submit (using the write() operation) a buffer with zero length to be written to the host, causing the qemu hypervisor instance running on that host to crash. This was caused by the write() operation triggering a virtqueue event on the host, causing a NULL buffer to be accessed. With this update, user space is no longer allowed to submit zero-sized buffers and the aforementioned crash no longer occur.
Story Points: ---
Clone Of:
: 636046 (view as bug list)
Environment:
Last Closed: 2011-05-23 16:52:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0542 normal SHIPPED_LIVE Important: Red Hat Enterprise Linux 6.1 kernel security, bug fix and enhancement update 2011-05-19 07:58:07 EDT

  None (edit)
Description Amit Shah 2010-09-20 02:05:43 EDT
Description of problem:

The virtio-console code was changed recently such that 0-sized writes go through to the host.  This results in a NULL pointer being passed to qemu, and qemu calling abort() in such a case.

To reproduce, open a console port in the guest and call write() with a 0-sized buffer.
Comment 3 RHEL Product and Program Management 2010-10-04 21:52:33 EDT
This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux maintenance release. Product Management has 
requested further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed 
products. This request is not yet committed for inclusion in an Update release.
Comment 4 Aristeu Rozanski 2010-12-13 10:14:35 EST
Patch(es) available on kernel-2.6.32-89.el6
Comment 7 Amos Kong 2011-01-25 02:45:00 EST
Bug can be reproduced with guest kernel kernel-2.6.32-84.el6, and doesn't exist on kernel-2.6.32-85.el6. Moving to VERIFIED.

(host) # qemu-kvm ... -device virtio-serial-pci,id=virtio-serial0,max_ports=31,bus=pci.0 -chardev pty,id=channel0 -device virtserialport,chardev=channel0,id=port0,bus=virtio-serial0.0
(host) # cat /dev/pts/2

//reproducer program, execute in guest
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>

int main(void)
{
        int f;
        char buf[]="";
        f = open("/dev/vport0p1", O_WRONLY);
        write(f,buf,0);
        close(f);
        return 0;
}
Comment 10 Martin Prpič 2011-04-12 08:41:33 EDT
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Prior to this update, user space could submit (using the write() operation) a buffer with zero length to be written to the host, causing the qemu hypervisor instance running on that host to crash. This was caused by the write() operation triggering a virtqueue event on the host, causing a NULL buffer to be accessed. With this update, user space is no longer allowed to submit zero-sized buffers and the aforementioned crash no longer occur.
Comment 11 errata-xmlrpc 2011-05-23 16:52:46 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0542.html

Note You need to log in before you can comment on or make changes to this bug.