OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

virtio: skip guest index check on device load

Browse Source 
QEMU must be careful when loading device state off migration streams to
prevent a malicious source from exploiting the emulator. Overdoing these
checks has the side effect of allowing a guest to "pin itself" in cloud
environments by messing with state which is entirely in its control.

Similarly to what f3081539 achieved in usb_device_post_load(), this
commit removes such a check from virtio_load(). Worth noting, the result
of a load without this check is the same as if a guest enables a VQ with
invalid indexes to begin with. That is, the virtual device is set in a
broken state (by the datapath handler) and must be reset.

Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
Message-Id: <20201028134643.110698-1-felipe@nutanix.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Felipe Franciosi 2020-10-28 13:47:03 +00:00 committed by Michael S. Tsirkin
parent adb29c0273
commit d68cdae30e
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
hw/virtio/virtio.c
View File

@ -17,6 +17,7 @@
#include "trace.h" #include "trace.h"
#include "exec/address-spaces.h" #include "exec/address-spaces.h"
#include "qemu/error-report.h" #include "qemu/error-report.h"
#include "qemu/log.h"
#include "qemu/main-loop.h" #include "qemu/main-loop.h"
#include "qemu/module.h" #include "qemu/module.h"
#include "hw/virtio/virtio.h" #include "hw/virtio/virtio.h"
@ -3160,12 +3161,12 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
nheads = vring_avail_idx(&vdev->vq[i]) - vdev->vq[i].last_avail_idx; nheads = vring_avail_idx(&vdev->vq[i]) - vdev->vq[i].last_avail_idx;
/* Check it isn't doing strange things with descriptor numbers. */ /* Check it isn't doing strange things with descriptor numbers. */
if (nheads > vdev->vq[i].vring.num) { if (nheads > vdev->vq[i].vring.num) {
error_report("VQ %d size 0x%x Guest index 0x%x " qemu_log_mask(LOG_GUEST_ERROR,
"inconsistent with Host index 0x%x: delta 0x%x", "VQ %d size 0x%x Guest index 0x%x "
i, vdev->vq[i].vring.num, "inconsistent with Host index 0x%x: delta 0x%x",
vring_avail_idx(&vdev->vq[i]), i, vdev->vq[i].vring.num,
vdev->vq[i].last_avail_idx, nheads); vring_avail_idx(&vdev->vq[i]),
return -1; vdev->vq[i].last_avail_idx, nheads);
} }
vdev->vq[i].used_idx = vring_used_idx(&vdev->vq[i]); vdev->vq[i].used_idx = vring_used_idx(&vdev->vq[i]);
vdev->vq[i].shadow_avail_idx = vring_avail_idx(&vdev->vq[i]); vdev->vq[i].shadow_avail_idx = vring_avail_idx(&vdev->vq[i]);