[Xen-changelog] [qemu-xen stable-4.7] virtio: error out if guest exceeds virtqueue size

[patchbot@xxxxxxx]

commit e927b5f5a809f07b73b063831527c8a87f053933
Author:     P J P <ppandit@xxxxxxxxxx>
AuthorDate: Mon Jul 25 17:37:18 2016 +0530
Commit:     Stefano Stabellini <sstabellini@xxxxxxxxxx>
CommitDate: Wed Jul 27 10:29:57 2016 -0700

    virtio: error out if guest exceeds virtqueue size
    
    A broken or malicious guest can submit more requests than the virtqueue
    size permits.
    
    The guest can submit requests without bothering to wait for completion
    and is therefore not bound by virtqueue size.  This requires reusing
    vring descriptors in more than one request, which is incorrect but
    possible.  Processing a request allocates a VirtQueueElement and
    therefore causes unbounded memory allocation controlled by the guest.
    
    Exit with an error if the guest provides more requests than the
    virtqueue size permits.  This bounds memory allocation and makes the
    buggy guest visible to the user.
    
    upstream-commit-id: afd9096eb1882f23929f5b5c177898ed231bac66
    Reported-by: Zhenhao Hong <zhenhaohong@xxxxxxxxx>
    Signed-off-by: Stefan Hajnoczi <stefanha@xxxxxxxxxx>
    Signed-off-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
---
 hw/virtio/virtio.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index d24f775..f8ac0fb 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -483,6 +483,11 @@ int virtqueue_pop(VirtQueue *vq, VirtQueueElement *elem)
 
     max = vq->vring.num;
 
+    if (vq->inuse >= max) {
+        error_report("Virtqueue size exceeded");
+        exit(1);
+    }
+
     i = head = virtqueue_get_head(vq, vq->last_avail_idx++);
     if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
         vring_set_avail_event(vq, vq->last_avail_idx);
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.7

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog