From c34f2c5fe908b63c9a86776abfca1a2162b1dd19 Mon Sep 17 00:00:00 2001 From: P J P Date: Tue, 26 Jul 2016 15:31:59 +0100 Subject: [PATCH] virtio: error out if guest exceeds virtqueue size A broken or malicious guest can submit more requests than the virtqueue size permits. The guest can submit requests without bothering to wait for completion and is therefore not bound by virtqueue size. This requires reusing vring descriptors in more than one request, which is incorrect but possible. Processing a request allocates a VirtQueueElement and therefore causes unbounded memory allocation controlled by the guest. Exit with an error if the guest provides more requests than the virtqueue size permits. This bounds memory allocation and makes the buggy guest visible to the user. Reported-by: Zhenhao Hong Signed-off-by: Stefan Hajnoczi (cherry picked from commit c4e0d84d3c92923fdbc7fa922638d54e5e834753) (cherry picked from commit 81111451256fd2f77c361fe65fa591743dbf04db) (cherry picked from commit cff044b5c8bf51d9c9f3f9439671ed378857928a) --- hw/virtio.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/virtio.c b/hw/virtio.c index c26feffc..42897bfe 100644 --- a/hw/virtio.c +++ b/hw/virtio.c @@ -421,6 +421,11 @@ int virtqueue_pop(VirtQueue *vq, VirtQueueElement *elem) /* When we start there are none of either input nor output. */ elem->out_num = elem->in_num = 0; + if (vq->inuse >= vq->vring.num) { + fprintf(stderr, "Virtqueue size exceeded"); + exit(1); + } + i = head = virtqueue_get_head(vq, vq->last_avail_idx++); do { struct iovec *sg; -- 2.39.5