diff options
| author | Jonah Palmer <jonah.palmer@oracle.com> | 2025-07-21 15:02:08 +0000 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2025-08-01 08:32:36 -0400 |
| commit | 6fcf5ebafad65adc19a616260ca7dc90005785d1 (patch) | |
| tree | c72c4ce798e93b8a65d57247b5749b8f26d95f3b /hw/net/virtio-net.c | |
| parent | 4e06566dbd1b1251c2788af26a30bd148d4eb6c1 (diff) | |
| download | focaccia-qemu-6fcf5ebafad65adc19a616260ca7dc90005785d1.tar.gz focaccia-qemu-6fcf5ebafad65adc19a616260ca7dc90005785d1.zip | |
virtio: fix off-by-one and invalid access in virtqueue_ordered_fill
Commit b44135daa372 introduced virtqueue_ordered_fill for
VIRTIO_F_IN_ORDER support but had a few issues:
* Conditional while loop used 'steps <= max_steps' but should've been
'steps < max_steps' since reaching steps == max_steps would indicate
that we didn't find an element, which is an error. Without this
change, the code would attempt to read invalid data at an index
outside of our search range.
* Incremented 'steps' using the next chain's ndescs instead of the
current one.
This patch corrects the loop bounds and synchronizes 'steps' and index
increments.
We also add a defensive sanity check against malicious or invalid
descriptor counts to avoid a potential infinite loop and DoS.
Fixes: b44135daa372 ("virtio: virtqueue_ordered_fill - VIRTIO_F_IN_ORDER support")
Reported-by: terrynini <terrynini38514@gmail.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Message-Id: <20250721150208.2409779-1-jonah.palmer@oracle.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/net/virtio-net.c')
0 files changed, 0 insertions, 0 deletions