File kvm-qemu-preXX-virtio-guard-against-negative-vq... of Package kvm

Overview Repositories Revisions Requests Users Attributes Meta

File kvm-qemu-preXX-virtio-guard-against-negative-vq-notifies.patch of Package kvm

From 7157e2e23e89adcd436caeab31fdd6b47eded377 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Date: Sun, 8 May 2011 22:29:07 +0100
Subject: [PATCH] virtio: guard against negative vq notifies

The virtio_queue_notify() function checks that the virtqueue number is
less than the maximum number of virtqueues.  A signed comparison is used
but the virtqueue number could be negative if a buggy or malicious guest
is run.  This results in memory accesses outside of the virtqueue array.

It is risky doing input validation in common code instead of at the
guest<->host boundary.  Note that virtio_queue_set_addr(),
virtio_queue_get_addr(), virtio_queue_get_num(), and many other virtio
functions do *not* validate the virtqueue number argument.

Instead of fixing the comparison in virtio_queue_notify(), move the
comparison to the virtio bindings (just like VIRTIO_PCI_QUEUE_SEL) where
we have a uint32_t value and can avoid ever calling into common virtio
code if the virtqueue number is invalid.

Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/syborg_virtio.c |    4 +++-
 hw/virtio-pci.c    |    4 +++-
 hw/virtio.c        |    4 +---
 3 files changed, 7 insertions(+), 5 deletions(-)

Index: qemu-kvm-0.12.5/hw/syborg_virtio.c
===================================================================
--- qemu-kvm-0.12.5.orig/hw/syborg_virtio.c
+++ qemu-kvm-0.12.5/hw/syborg_virtio.c
@@ -145,7 +145,9 @@ static void syborg_virtio_writel(void *o
             vdev->queue_sel = value;
         break;
     case SYBORG_VIRTIO_QUEUE_NOTIFY:
-        virtio_queue_notify(vdev, value);
+        if (value < VIRTIO_PCI_QUEUE_MAX) {
+            virtio_queue_notify(vdev, value);
+        }
         break;
     case SYBORG_VIRTIO_STATUS:
         vdev->status = value & 0xFF;
Index: qemu-kvm-0.12.5/hw/virtio-pci.c
===================================================================
--- qemu-kvm-0.12.5.orig/hw/virtio-pci.c
+++ qemu-kvm-0.12.5/hw/virtio-pci.c
@@ -197,7 +197,9 @@ static void virtio_ioport_write(void *op
             vdev->queue_sel = val;
         break;
     case VIRTIO_PCI_QUEUE_NOTIFY:
-        virtio_queue_notify(vdev, val);
+        if (val < VIRTIO_PCI_QUEUE_MAX) {
+            virtio_queue_notify(vdev, val);
+        }
         break;
     case VIRTIO_PCI_STATUS:
         vdev->status = val & 0xFF;
Index: qemu-kvm-0.12.5/hw/virtio.c
===================================================================
--- qemu-kvm-0.12.5.orig/hw/virtio.c
+++ qemu-kvm-0.12.5/hw/virtio.c
@@ -568,7 +568,7 @@ int virtio_queue_get_num(VirtIODevice *v
 
 void virtio_queue_notify(VirtIODevice *vdev, int n)
 {
-    if (n < VIRTIO_PCI_QUEUE_MAX && vdev->vq[n].vring.desc) {
+    if (vdev->vq[n].vring.desc) {
         vdev->vq[n].handle_output(vdev, &vdev->vq[n]);
     }
 }

Places

File kvm-qemu-preXX-virtio-guard-against-negative-vq-notifies.patch of Package kvm

Places