[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] virtio: guard against negative vq notifies
From: |
Stefan Hajnoczi |
Subject: |
Re: [Qemu-devel] [PATCH] virtio: guard against negative vq notifies |
Date: |
Mon, 9 May 2011 14:57:49 +0100 |
On Sun, May 8, 2011 at 10:29 PM, Stefan Hajnoczi
<address@hidden> wrote:
> The virtio_queue_notify() function checks that the virtqueue number is
> less than the maximum number of virtqueues. A signed comparison is used
> but the virtqueue number could be negative if a buggy or malicious guest
> is run. This results in memory accesses outside of the virtqueue array.
>
> It is risky doing input validation in common code instead of at the
> guest<->host boundary. Note that virtio_queue_set_addr(),
> virtio_queue_get_addr(), virtio_queue_get_num(), and many other virtio
> functions do *not* validate the virtqueue number argument.
>
> Instead of fixing the comparison in virtio_queue_notify(), move the
> comparison to the virtio bindings (just like VIRTIO_PCI_QUEUE_SEL) where
> we have a uint32_t value and can avoid ever calling into common virtio
> code if the virtqueue number is invalid.
>
> Signed-off-by: Stefan Hajnoczi <address@hidden>
> ---
> hw/syborg_virtio.c | 4 +++-
> hw/virtio-pci.c | 4 +++-
> hw/virtio.c | 4 +---
> 3 files changed, 7 insertions(+), 5 deletions(-)
Please consider this patch for the stable tree once Michael is happy:
http://patchwork.ozlabs.org/patch/94604/
Stefan