scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)
[qemu.git] / util / iov.c
1 /*
2 * Helpers for getting linearized buffers from iov / filling buffers into iovs
3 *
4 * Copyright IBM, Corp. 2007, 2008
5 * Copyright (C) 2010 Red Hat, Inc.
6 *
7 * Author(s):
8 * Anthony Liguori <aliguori@us.ibm.com>
9 * Amit Shah <amit.shah@redhat.com>
10 * Michael Tokarev <mjt@tls.msk.ru>
11 *
12 * This work is licensed under the terms of the GNU GPL, version 2. See
13 * the COPYING file in the top-level directory.
14 *
15 * Contributions after 2012-01-13 are licensed under the terms of the
16 * GNU GPL, version 2 or (at your option) any later version.
17 */
18
19 #include "qemu/osdep.h"
20 #include "qemu-common.h"
21 #include "qemu/iov.h"
22 #include "qemu/sockets.h"
23 #include "qemu/cutils.h"
24
25 size_t iov_from_buf_full(const struct iovec *iov, unsigned int iov_cnt,
26 size_t offset, const void *buf, size_t bytes)
27 {
28 size_t done;
29 unsigned int i;
30 for (i = 0, done = 0; (offset || done < bytes) && i < iov_cnt; i++) {
31 if (offset < iov[i].iov_len) {
32 size_t len = MIN(iov[i].iov_len - offset, bytes - done);
33 memcpy(iov[i].iov_base + offset, buf + done, len);
34 done += len;
35 offset = 0;
36 } else {
37 offset -= iov[i].iov_len;
38 }
39 }
40 assert(offset == 0);
41 return done;
42 }
43
44 size_t iov_to_buf_full(const struct iovec *iov, const unsigned int iov_cnt,
45 size_t offset, void *buf, size_t bytes)
46 {
47 size_t done;
48 unsigned int i;
49 for (i = 0, done = 0; (offset || done < bytes) && i < iov_cnt; i++) {
50 if (offset < iov[i].iov_len) {
51 size_t len = MIN(iov[i].iov_len - offset, bytes - done);
52 memcpy(buf + done, iov[i].iov_base + offset, len);
53 done += len;
54 offset = 0;
55 } else {
56 offset -= iov[i].iov_len;
57 }
58 }
59 assert(offset == 0);
60 return done;
61 }
62
63 size_t iov_memset(const struct iovec *iov, const unsigned int iov_cnt,
64 size_t offset, int fillc, size_t bytes)
65 {
66 size_t done;
67 unsigned int i;
68 for (i = 0, done = 0; (offset || done < bytes) && i < iov_cnt; i++) {
69 if (offset < iov[i].iov_len) {
70 size_t len = MIN(iov[i].iov_len - offset, bytes - done);
71 memset(iov[i].iov_base + offset, fillc, len);
72 done += len;
73 offset = 0;
74 } else {
75 offset -= iov[i].iov_len;
76 }
77 }
78 assert(offset == 0);
79 return done;
80 }
81
82 size_t iov_size(const struct iovec *iov, const unsigned int iov_cnt)
83 {
84 size_t len;
85 unsigned int i;
86
87 len = 0;
88 for (i = 0; i < iov_cnt; i++) {
89 len += iov[i].iov_len;
90 }
91 return len;
92 }
93
94 /* helper function for iov_send_recv() */
95 static ssize_t
96 do_send_recv(int sockfd, struct iovec *iov, unsigned iov_cnt, bool do_send)
97 {
98 #ifdef CONFIG_POSIX
99 ssize_t ret;
100 struct msghdr msg;
101 memset(&msg, 0, sizeof(msg));
102 msg.msg_iov = iov;
103 msg.msg_iovlen = iov_cnt;
104 do {
105 ret = do_send
106 ? sendmsg(sockfd, &msg, 0)
107 : recvmsg(sockfd, &msg, 0);
108 } while (ret < 0 && errno == EINTR);
109 return ret;
110 #else
111 /* else send piece-by-piece */
112 /*XXX Note: windows has WSASend() and WSARecv() */
113 unsigned i = 0;
114 ssize_t ret = 0;
115 while (i < iov_cnt) {
116 ssize_t r = do_send
117 ? send(sockfd, iov[i].iov_base, iov[i].iov_len, 0)
118 : recv(sockfd, iov[i].iov_base, iov[i].iov_len, 0);
119 if (r > 0) {
120 ret += r;
121 } else if (!r) {
122 break;
123 } else if (errno == EINTR) {
124 continue;
125 } else {
126 /* else it is some "other" error,
127 * only return if there was no data processed. */
128 if (ret == 0) {
129 ret = -1;
130 }
131 break;
132 }
133 i++;
134 }
135 return ret;
136 #endif
137 }
138
139 ssize_t iov_send_recv(int sockfd, const struct iovec *_iov, unsigned iov_cnt,
140 size_t offset, size_t bytes,
141 bool do_send)
142 {
143 ssize_t total = 0;
144 ssize_t ret;
145 size_t orig_len, tail;
146 unsigned niov;
147 struct iovec *local_iov, *iov;
148
149 if (bytes <= 0) {
150 return 0;
151 }
152
153 local_iov = g_new0(struct iovec, iov_cnt);
154 iov_copy(local_iov, iov_cnt, _iov, iov_cnt, offset, bytes);
155 offset = 0;
156 iov = local_iov;
157
158 while (bytes > 0) {
159 /* Find the start position, skipping `offset' bytes:
160 * first, skip all full-sized vector elements, */
161 for (niov = 0; niov < iov_cnt && offset >= iov[niov].iov_len; ++niov) {
162 offset -= iov[niov].iov_len;
163 }
164
165 /* niov == iov_cnt would only be valid if bytes == 0, which
166 * we already ruled out in the loop condition. */
167 assert(niov < iov_cnt);
168 iov += niov;
169 iov_cnt -= niov;
170
171 if (offset) {
172 /* second, skip `offset' bytes from the (now) first element,
173 * undo it on exit */
174 iov[0].iov_base += offset;
175 iov[0].iov_len -= offset;
176 }
177 /* Find the end position skipping `bytes' bytes: */
178 /* first, skip all full-sized elements */
179 tail = bytes;
180 for (niov = 0; niov < iov_cnt && iov[niov].iov_len <= tail; ++niov) {
181 tail -= iov[niov].iov_len;
182 }
183 if (tail) {
184 /* second, fixup the last element, and remember the original
185 * length */
186 assert(niov < iov_cnt);
187 assert(iov[niov].iov_len > tail);
188 orig_len = iov[niov].iov_len;
189 iov[niov++].iov_len = tail;
190 ret = do_send_recv(sockfd, iov, niov, do_send);
191 /* Undo the changes above before checking for errors */
192 iov[niov-1].iov_len = orig_len;
193 } else {
194 ret = do_send_recv(sockfd, iov, niov, do_send);
195 }
196 if (offset) {
197 iov[0].iov_base -= offset;
198 iov[0].iov_len += offset;
199 }
200
201 if (ret < 0) {
202 assert(errno != EINTR);
203 g_free(local_iov);
204 if (errno == EAGAIN && total > 0) {
205 return total;
206 }
207 return -1;
208 }
209
210 if (ret == 0 && !do_send) {
211 /* recv returns 0 when the peer has performed an orderly
212 * shutdown. */
213 break;
214 }
215
216 /* Prepare for the next iteration */
217 offset += ret;
218 total += ret;
219 bytes -= ret;
220 }
221
222 g_free(local_iov);
223 return total;
224 }
225
226
227 void iov_hexdump(const struct iovec *iov, const unsigned int iov_cnt,
228 FILE *fp, const char *prefix, size_t limit)
229 {
230 int v;
231 size_t size = 0;
232 char *buf;
233
234 for (v = 0; v < iov_cnt; v++) {
235 size += iov[v].iov_len;
236 }
237 size = size > limit ? limit : size;
238 buf = g_malloc(size);
239 iov_to_buf(iov, iov_cnt, 0, buf, size);
240 qemu_hexdump(buf, fp, prefix, size);
241 g_free(buf);
242 }
243
244 unsigned iov_copy(struct iovec *dst_iov, unsigned int dst_iov_cnt,
245 const struct iovec *iov, unsigned int iov_cnt,
246 size_t offset, size_t bytes)
247 {
248 size_t len;
249 unsigned int i, j;
250 for (i = 0, j = 0; i < iov_cnt && j < dst_iov_cnt && bytes; i++) {
251 if (offset >= iov[i].iov_len) {
252 offset -= iov[i].iov_len;
253 continue;
254 }
255 len = MIN(bytes, iov[i].iov_len - offset);
256
257 dst_iov[j].iov_base = iov[i].iov_base + offset;
258 dst_iov[j].iov_len = len;
259 j++;
260 bytes -= len;
261 offset = 0;
262 }
263 assert(offset == 0);
264 return j;
265 }
266
267 /* io vectors */
268
269 void qemu_iovec_init(QEMUIOVector *qiov, int alloc_hint)
270 {
271 qiov->iov = g_new(struct iovec, alloc_hint);
272 qiov->niov = 0;
273 qiov->nalloc = alloc_hint;
274 qiov->size = 0;
275 }
276
277 void qemu_iovec_init_external(QEMUIOVector *qiov, struct iovec *iov, int niov)
278 {
279 int i;
280
281 qiov->iov = iov;
282 qiov->niov = niov;
283 qiov->nalloc = -1;
284 qiov->size = 0;
285 for (i = 0; i < niov; i++)
286 qiov->size += iov[i].iov_len;
287 }
288
289 void qemu_iovec_add(QEMUIOVector *qiov, void *base, size_t len)
290 {
291 assert(qiov->nalloc != -1);
292
293 if (qiov->niov == qiov->nalloc) {
294 qiov->nalloc = 2 * qiov->nalloc + 1;
295 qiov->iov = g_renew(struct iovec, qiov->iov, qiov->nalloc);
296 }
297 qiov->iov[qiov->niov].iov_base = base;
298 qiov->iov[qiov->niov].iov_len = len;
299 qiov->size += len;
300 ++qiov->niov;
301 }
302
303 /*
304 * Concatenates (partial) iovecs from src_iov to the end of dst.
305 * It starts copying after skipping `soffset' bytes at the
306 * beginning of src and adds individual vectors from src to
307 * dst copies up to `sbytes' bytes total, or up to the end
308 * of src_iov if it comes first. This way, it is okay to specify
309 * very large value for `sbytes' to indicate "up to the end
310 * of src".
311 * Only vector pointers are processed, not the actual data buffers.
312 */
313 size_t qemu_iovec_concat_iov(QEMUIOVector *dst,
314 struct iovec *src_iov, unsigned int src_cnt,
315 size_t soffset, size_t sbytes)
316 {
317 int i;
318 size_t done;
319
320 if (!sbytes) {
321 return 0;
322 }
323 assert(dst->nalloc != -1);
324 for (i = 0, done = 0; done < sbytes && i < src_cnt; i++) {
325 if (soffset < src_iov[i].iov_len) {
326 size_t len = MIN(src_iov[i].iov_len - soffset, sbytes - done);
327 qemu_iovec_add(dst, src_iov[i].iov_base + soffset, len);
328 done += len;
329 soffset = 0;
330 } else {
331 soffset -= src_iov[i].iov_len;
332 }
333 }
334 assert(soffset == 0); /* offset beyond end of src */
335
336 return done;
337 }
338
339 /*
340 * Concatenates (partial) iovecs from src to the end of dst.
341 * It starts copying after skipping `soffset' bytes at the
342 * beginning of src and adds individual vectors from src to
343 * dst copies up to `sbytes' bytes total, or up to the end
344 * of src if it comes first. This way, it is okay to specify
345 * very large value for `sbytes' to indicate "up to the end
346 * of src".
347 * Only vector pointers are processed, not the actual data buffers.
348 */
349 void qemu_iovec_concat(QEMUIOVector *dst,
350 QEMUIOVector *src, size_t soffset, size_t sbytes)
351 {
352 qemu_iovec_concat_iov(dst, src->iov, src->niov, soffset, sbytes);
353 }
354
355 /*
356 * Check if the contents of the iovecs are all zero
357 */
358 bool qemu_iovec_is_zero(QEMUIOVector *qiov)
359 {
360 int i;
361 for (i = 0; i < qiov->niov; i++) {
362 size_t offs = QEMU_ALIGN_DOWN(qiov->iov[i].iov_len, 4 * sizeof(long));
363 uint8_t *ptr = qiov->iov[i].iov_base;
364 if (offs && !buffer_is_zero(qiov->iov[i].iov_base, offs)) {
365 return false;
366 }
367 for (; offs < qiov->iov[i].iov_len; offs++) {
368 if (ptr[offs]) {
369 return false;
370 }
371 }
372 }
373 return true;
374 }
375
376 void qemu_iovec_destroy(QEMUIOVector *qiov)
377 {
378 assert(qiov->nalloc != -1);
379
380 qemu_iovec_reset(qiov);
381 g_free(qiov->iov);
382 qiov->nalloc = 0;
383 qiov->iov = NULL;
384 }
385
386 void qemu_iovec_reset(QEMUIOVector *qiov)
387 {
388 assert(qiov->nalloc != -1);
389
390 qiov->niov = 0;
391 qiov->size = 0;
392 }
393
394 size_t qemu_iovec_to_buf(QEMUIOVector *qiov, size_t offset,
395 void *buf, size_t bytes)
396 {
397 return iov_to_buf(qiov->iov, qiov->niov, offset, buf, bytes);
398 }
399
400 size_t qemu_iovec_from_buf(QEMUIOVector *qiov, size_t offset,
401 const void *buf, size_t bytes)
402 {
403 return iov_from_buf(qiov->iov, qiov->niov, offset, buf, bytes);
404 }
405
406 size_t qemu_iovec_memset(QEMUIOVector *qiov, size_t offset,
407 int fillc, size_t bytes)
408 {
409 return iov_memset(qiov->iov, qiov->niov, offset, fillc, bytes);
410 }
411
412 /**
413 * Check that I/O vector contents are identical
414 *
415 * The IO vectors must have the same structure (same length of all parts).
416 * A typical usage is to compare vectors created with qemu_iovec_clone().
417 *
418 * @a: I/O vector
419 * @b: I/O vector
420 * @ret: Offset to first mismatching byte or -1 if match
421 */
422 ssize_t qemu_iovec_compare(QEMUIOVector *a, QEMUIOVector *b)
423 {
424 int i;
425 ssize_t offset = 0;
426
427 assert(a->niov == b->niov);
428 for (i = 0; i < a->niov; i++) {
429 size_t len = 0;
430 uint8_t *p = (uint8_t *)a->iov[i].iov_base;
431 uint8_t *q = (uint8_t *)b->iov[i].iov_base;
432
433 assert(a->iov[i].iov_len == b->iov[i].iov_len);
434 while (len < a->iov[i].iov_len && *p++ == *q++) {
435 len++;
436 }
437
438 offset += len;
439
440 if (len != a->iov[i].iov_len) {
441 return offset;
442 }
443 }
444 return -1;
445 }
446
447 typedef struct {
448 int src_index;
449 struct iovec *src_iov;
450 void *dest_base;
451 } IOVectorSortElem;
452
453 static int sortelem_cmp_src_base(const void *a, const void *b)
454 {
455 const IOVectorSortElem *elem_a = a;
456 const IOVectorSortElem *elem_b = b;
457
458 /* Don't overflow */
459 if (elem_a->src_iov->iov_base < elem_b->src_iov->iov_base) {
460 return -1;
461 } else if (elem_a->src_iov->iov_base > elem_b->src_iov->iov_base) {
462 return 1;
463 } else {
464 return 0;
465 }
466 }
467
468 static int sortelem_cmp_src_index(const void *a, const void *b)
469 {
470 const IOVectorSortElem *elem_a = a;
471 const IOVectorSortElem *elem_b = b;
472
473 return elem_a->src_index - elem_b->src_index;
474 }
475
476 /**
477 * Copy contents of I/O vector
478 *
479 * The relative relationships of overlapping iovecs are preserved. This is
480 * necessary to ensure identical semantics in the cloned I/O vector.
481 */
482 void qemu_iovec_clone(QEMUIOVector *dest, const QEMUIOVector *src, void *buf)
483 {
484 IOVectorSortElem sortelems[src->niov];
485 void *last_end;
486 int i;
487
488 /* Sort by source iovecs by base address */
489 for (i = 0; i < src->niov; i++) {
490 sortelems[i].src_index = i;
491 sortelems[i].src_iov = &src->iov[i];
492 }
493 qsort(sortelems, src->niov, sizeof(sortelems[0]), sortelem_cmp_src_base);
494
495 /* Allocate buffer space taking into account overlapping iovecs */
496 last_end = NULL;
497 for (i = 0; i < src->niov; i++) {
498 struct iovec *cur = sortelems[i].src_iov;
499 ptrdiff_t rewind = 0;
500
501 /* Detect overlap */
502 if (last_end && last_end > cur->iov_base) {
503 rewind = last_end - cur->iov_base;
504 }
505
506 sortelems[i].dest_base = buf - rewind;
507 buf += cur->iov_len - MIN(rewind, cur->iov_len);
508 last_end = MAX(cur->iov_base + cur->iov_len, last_end);
509 }
510
511 /* Sort by source iovec index and build destination iovec */
512 qsort(sortelems, src->niov, sizeof(sortelems[0]), sortelem_cmp_src_index);
513 for (i = 0; i < src->niov; i++) {
514 qemu_iovec_add(dest, sortelems[i].dest_base, src->iov[i].iov_len);
515 }
516 }
517
518 size_t iov_discard_front(struct iovec **iov, unsigned int *iov_cnt,
519 size_t bytes)
520 {
521 size_t total = 0;
522 struct iovec *cur;
523
524 for (cur = *iov; *iov_cnt > 0; cur++) {
525 if (cur->iov_len > bytes) {
526 cur->iov_base += bytes;
527 cur->iov_len -= bytes;
528 total += bytes;
529 break;
530 }
531
532 bytes -= cur->iov_len;
533 total += cur->iov_len;
534 *iov_cnt -= 1;
535 }
536
537 *iov = cur;
538 return total;
539 }
540
541 size_t iov_discard_back(struct iovec *iov, unsigned int *iov_cnt,
542 size_t bytes)
543 {
544 size_t total = 0;
545 struct iovec *cur;
546
547 if (*iov_cnt == 0) {
548 return 0;
549 }
550
551 cur = iov + (*iov_cnt - 1);
552
553 while (*iov_cnt > 0) {
554 if (cur->iov_len > bytes) {
555 cur->iov_len -= bytes;
556 total += bytes;
557 break;
558 }
559
560 bytes -= cur->iov_len;
561 total += cur->iov_len;
562 cur--;
563 *iov_cnt -= 1;
564 }
565
566 return total;
567 }
568
569 void qemu_iovec_discard_back(QEMUIOVector *qiov, size_t bytes)
570 {
571 size_t total;
572 unsigned int niov = qiov->niov;
573
574 assert(qiov->size >= bytes);
575 total = iov_discard_back(qiov->iov, &niov, bytes);
576 assert(total == bytes);
577
578 qiov->niov = niov;
579 qiov->size -= bytes;
580 }