[PATCH] hw/pvrdma: Protect against buggy or malicious guest driver

Yuval Shaia posted 1 patch 1 year, 1 month ago
There is a newer version of this series
hw/rdma/vmw/pvrdma_main.c | 8 ++++++++
1 file changed, 8 insertions(+)
[PATCH] hw/pvrdma: Protect against buggy or malicious guest driver
Posted by Yuval Shaia 1 year, 1 month ago
Guest driver allocates and initialize page tables to be used as a ring
of descriptors for CQ and async events.
The page table that represents the ring, along with the number of pages
in the page table is passed to the device.
Currently our device supports only one page table for a ring.

Let's make sure that the number of page table entries the driver
reports, do not exceeds the one page table size.

Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
---
 hw/rdma/vmw/pvrdma_main.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/rdma/vmw/pvrdma_main.c b/hw/rdma/vmw/pvrdma_main.c
index 4fc6712025..e84d68a81f 100644
--- a/hw/rdma/vmw/pvrdma_main.c
+++ b/hw/rdma/vmw/pvrdma_main.c
@@ -98,12 +98,20 @@ static int init_dev_ring(PvrdmaRing *ring, PvrdmaRingState **ring_state,
         return -EINVAL;
     }
 
+    if (num_pages > TARGET_PAGE_SIZE / sizeof(dma_addr_t)) {
+        rdma_error_report("Maximum pages on a single directory must not exceed %ld\n",
+                          TARGET_PAGE_SIZE / sizeof(dma_addr_t));
+        return -EINVAL;
+    }
+
     dir = rdma_pci_dma_map(pci_dev, dir_addr, TARGET_PAGE_SIZE);
     if (!dir) {
         rdma_error_report("Failed to map to page directory (ring %s)", name);
         rc = -ENOMEM;
         goto out;
     }
+
+    /* We support only one page table for a ring */
     tbl = rdma_pci_dma_map(pci_dev, dir[0], TARGET_PAGE_SIZE);
     if (!tbl) {
         rdma_error_report("Failed to map to page table (ring %s)", name);
-- 
2.20.1