From 7157e2e23e89adcd436caeab31fdd6b47eded377 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Sun, 8 May 2011 22:29:07 +0100 Subject: virtio: guard against negative vq notifies The virtio_queue_notify() function checks that the virtqueue number is less than the maximum number of virtqueues. A signed comparison is used but the virtqueue number could be negative if a buggy or malicious guest is run. This results in memory accesses outside of the virtqueue array. It is risky doing input validation in common code instead of at the guest<->host boundary. Note that virtio_queue_set_addr(), virtio_queue_get_addr(), virtio_queue_get_num(), and many other virtio functions do *not* validate the virtqueue number argument. Instead of fixing the comparison in virtio_queue_notify(), move the comparison to the virtio bindings (just like VIRTIO_PCI_QUEUE_SEL) where we have a uint32_t value and can avoid ever calling into common virtio code if the virtqueue number is invalid. Signed-off-by: Stefan Hajnoczi Signed-off-by: Michael S. Tsirkin --- hw/virtio.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'hw/virtio.c') diff --git a/hw/virtio.c b/hw/virtio.c index 6e8814cb64..a6518606c3 100644 --- a/hw/virtio.c +++ b/hw/virtio.c @@ -585,9 +585,7 @@ void virtio_queue_notify_vq(VirtQueue *vq) void virtio_queue_notify(VirtIODevice *vdev, int n) { - if (n < VIRTIO_PCI_QUEUE_MAX) { - virtio_queue_notify_vq(&vdev->vq[n]); - } + virtio_queue_notify_vq(&vdev->vq[n]); } uint16_t virtio_queue_vector(VirtIODevice *vdev, int n) -- cgit 1.4.1