diff options
| author | Yuval Shaia <yuval.shaia.ml@gmail.com> | 2022-04-03 12:52:34 +0300 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2023-03-30 12:19:04 +0300 |
| commit | a2efa1fac49b7d7d10564ef0007b2ed02e69fdf5 (patch) | |
| tree | 8b040df7630ce9a9277002fea5f96d34ee3b6460 | |
| parent | b209cc4556d56938fa8a933670b8fb98c036af37 (diff) | |
| download | qemu-a2efa1fac49b7d7d10564ef0007b2ed02e69fdf5.zip qemu-a2efa1fac49b7d7d10564ef0007b2ed02e69fdf5.tar.gz qemu-a2efa1fac49b7d7d10564ef0007b2ed02e69fdf5.tar.bz2 | |
hw/pvrdma: Protect against buggy or malicious guest driver
Guest driver might execute HW commands when shared buffers are not yet
allocated.
This could happen on purpose (malicious guest) or because of some other
guest/host address mapping error.
We need to protect againts such case.
Fixes: CVE-2022-1050
Reported-by: Raven <wxhusst@gmail.com>
Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
Message-Id: <20220403095234.2210-1-yuval.shaia.ml@gmail.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
(cherry picked from commit 31c4b6fb0293e359f9ef8a61892667e76eea4c99)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/rdma/vmw/pvrdma_cmd.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c index da7ddfa..89db963 100644 --- a/hw/rdma/vmw/pvrdma_cmd.c +++ b/hw/rdma/vmw/pvrdma_cmd.c @@ -796,6 +796,12 @@ int pvrdma_exec_cmd(PVRDMADev *dev) dsr_info = &dev->dsr_info; + if (!dsr_info->dsr) { + /* Buggy or malicious guest driver */ + rdma_error_report("Exec command without dsr, req or rsp buffers"); + goto out; + } + if (dsr_info->req->hdr.cmd >= sizeof(cmd_handlers) / sizeof(struct cmd_handler)) { rdma_error_report("Unsupported command"); |