github/acrn-hypervisor
1
0
Fork 0
mirror of https://github.com/projectacrn/acrn-hypervisor.git synced 2025-06-26 15:31:35 +00:00
Code Issues Projects Releases Wiki Activity

dm: fix fault Injection into VirtIO console backend

Browse Source 
CVE# CVE-2021-23905
 Add Null pointer check in init vq ring and add vq ring descriptor
 check in case cause Nullpointer exception.

Tracked-On: #5355
Signed-off-by: Liu Long <long.liu@intel.com>
Reviewed-by: Wang, Yu1 <yu1.wang@intel.com>
This commit is contained in:
Liu Long 2020-09-25 13:41:25 +08:00 committed by wenlingz
parent f2331e71bc
commit 069c7aceeb
3 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
devicemodel/core/vmmapi.c
View File

@ -472,6 +472,7 @@ vm_map_gpa(struct vmctx *ctx, vm_paddr_t gaddr, size_t len)
}
}
pr_dbg("%s context memory is not valid!\n", __func__);
return NULL;
}

10
devicemodel/hw/pci/virtio/virtio.c
View File

@ -342,18 +342,25 @@ virtio_vq_enable(struct virtio_base *base)
phys = (((uint64_t)vq->gpa_desc[1]) << 32) | vq->gpa_desc[0];
size = qsz * sizeof(struct vring_desc);
vb = paddr_guest2host(base->dev->vmctx, phys, size);
if (!vb)
goto error;
vq->desc = (struct vring_desc *)vb;
/* available ring */
phys = (((uint64_t)vq->gpa_avail[1]) << 32) | vq->gpa_avail[0];
size = (2 + qsz + 1) * sizeof(uint16_t);
vb = paddr_guest2host(base->dev->vmctx, phys, size);
if (!vb)
goto error;
vq->avail = (struct vring_avail *)vb;
/* used ring */
phys = (((uint64_t)vq->gpa_used[1]) << 32) | vq->gpa_used[0];
size = sizeof(uint16_t) * 3 + sizeof(struct vring_used_elem) * qsz;
vb = paddr_guest2host(base->dev->vmctx, phys, size);
if (!vb)
goto error;
vq->used = (struct vring_used *)vb;
/* Start at 0 when we use it. */
@ -366,6 +373,9 @@ virtio_vq_enable(struct virtio_base *base)
/* Mark queue as allocated after initialization is complete. */
mb();
vq->flags = VQ_ALLOC;
error:
vq->flags = 0;
pr_err("%s: vq enable failed\n", __func__);
}
/*

4
devicemodel/hw/pci/virtio/virtio_console.c
View File

@ -412,7 +412,9 @@ virtio_console_notify_rx(void *vdev, struct virtio_vq_info *vq)
if (!port->rx_ready) {
port->rx_ready = 1;
vq->used->flags |= VRING_USED_F_NO_NOTIFY;
if (vq_has_descs(vq)) {
vq->used->flags |= VRING_USED_F_NO_NOTIFY;
}
}
}