fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
qemu-cr16/hw
History
Jonah Palmer 6fcf5ebafa virtio: fix off-by-one and invalid access in virtqueue_ordered_fill 
Commit b44135daa3 introduced virtqueue_ordered_fill for
VIRTIO_F_IN_ORDER support but had a few issues:

* Conditional while loop used 'steps <= max_steps' but should've been
  'steps < max_steps' since reaching steps == max_steps would indicate
  that we didn't find an element, which is an error. Without this
  change, the code would attempt to read invalid data at an index
  outside of our search range.

* Incremented 'steps' using the next chain's ndescs instead of the
  current one.

This patch corrects the loop bounds and synchronizes 'steps' and index
increments.

We also add a defensive sanity check against malicious or invalid
descriptor counts to avoid a potential infinite loop and DoS.

Fixes: b44135daa3 ("virtio: virtqueue_ordered_fill - VIRTIO_F_IN_ORDER support")
Reported-by: terrynini <terrynini38514@gmail.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Message-Id: <20250721150208.2409779-1-jonah.palmer@oracle.com>
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-01 08:32:36 -04:00
..
9pfs hw/9pfs: move G_GNUC_PRINTF to header 2025-07-16 14:18:48 +02:00
acpi hw/acpi/aml-build: Build a root node in the PPTT table 2025-07-15 02:56:40 -04:00
adc qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
alpha qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
arm hw/arm/smmu-common: Avoid using inlined functions with external linkage 2025-07-25 10:35:18 +01:00
audio hw/audio/via-ac97: skip automatic zero-init of large array 2025-06-12 13:40:15 -04:00
avr qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
block hw/virtio: Build various files once 2025-07-15 02:56:39 -04:00
char qemu: Declare all load/store helper in 'qemu/bswap.h' 2025-07-15 02:56:39 -04:00
core hw/i386: Fix 'use-legacy-x86-rom' property compatibility 2025-07-28 17:52:34 +02:00
cpu qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
cxl hw/cxl: mailbox-utils: 0x5605 - FMAPI Initiate DC Release 2025-07-15 02:56:40 -04:00
display hw/display/sm501: fix missing error-report.h 2025-07-29 13:56:39 +02:00
dma hw/dma/xlnx_csu_dma: skip automatic zero-init of large array 2025-06-12 13:40:15 -04:00
fsi qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
gpio hw/gpio/pca9552: Avoid using g_newa() 2025-06-10 12:59:09 +02:00
hppa qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
hyperv hw/hyperv/syndbg: skip automatic zero-init of large array 2025-06-12 13:40:15 -04:00
i2c hw/arm: Replace TABs for spaces in OMAP board and device code 2025-05-14 14:29:47 +01:00
i386 i386: Build SEV only for 64-bit target 2025-07-28 17:52:34 +02:00
ide qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
input vhost-user: return failure if backend crash when live migration 2025-05-14 05:39:15 -04:00
intc intc/riscv_aplic: Fix target register read when source is inactive 2025-07-30 10:59:26 +10:00
ipack qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
ipmi qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
isa hw/isa/ich9: Remove stray empty comment 2025-05-09 23:49:26 +03:00
loongarch acpi: Add machine option to disable SPCR table 2025-07-14 09:16:40 -04:00
m68k qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
mem hw/cxl: mailbox-utils: 0x5604 - FMAPI Initiate DC Add 2025-07-15 02:56:40 -04:00
microblaze hw/microblaze: Add missing FDT dependency 2025-07-15 00:24:26 +02:00
mips hw/mips: Restrict ITU to TCG 2025-07-15 00:24:26 +02:00
misc hw/misc/max78000_aes: Comment Internal Key Storage 2025-07-21 10:07:53 +01:00
net hw/net/cadence_gem: fix register mask initialization 2025-07-29 13:56:39 +02:00
nubus qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
nvme treewide: fix paths for relocated files in comments 2025-07-02 18:26:27 +02:00
nvram hw/nvram/fw_cfg: Remove legacy FW_CFG_ORDER_OVERRIDE 2025-05-30 09:52:08 +02:00
openrisc qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
pci pci: skip reset during cpr 2025-06-11 14:01:58 +02:00
pci-bridge qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
pci-host hw/pci-host/gpex-acpi: Use build_pci_host_bridge_osc_method 2025-07-15 02:56:40 -04:00
ppc ppc/xive: Change presenter .match_nvt to match not present 2025-07-21 08:03:52 +02:00
remote qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
riscv hw/riscv/virt-acpi-build.c: Update FADT and MADT versions 2025-07-30 10:59:26 +10:00
rtc hw/rtc/mc146818rtc: Drop pre-v3 migration stream support 2025-04-30 20:44:20 +02:00
rx qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
s390x qemu: Declare all load/store helper in 'qemu/bswap.h' 2025-07-15 02:56:39 -04:00
scsi esp.c: only allow ESP commands permitted in the current asc_mode 2025-07-15 00:25:21 +02:00
sd qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
sensor qemu: Declare all load/store helper in 'qemu/bswap.h' 2025-07-15 02:56:39 -04:00
sh4 include: Remove 'exec/exec-all.h' 2025-04-30 12:45:05 -07:00
smbios qemu: Declare all load/store helper in 'qemu/bswap.h' 2025-07-15 02:56:39 -04:00
sparc qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
sparc64 qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
ssi hw/ssi/aspeed_smc: Allow 64-bit wide flash accesses 2025-05-05 09:38:55 +02:00
timer hpet: return errors from realize if properties are incorrect 2025-06-06 14:32:54 +02:00
tpm qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
tricore qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
uefi hw/uefi: Create and use trace.h wrapper header 2025-07-13 12:08:07 +03:00
ufs hw/ufs/lu: skip automatic zero-init of large array 2025-06-12 13:40:16 -04:00
usb hw/usb/dev-hid: Support side and extra mouse buttons for usb-tablet 2025-07-13 12:08:07 +03:00
vfio Misc HW patches 2025-07-29 10:54:13 -04:00
vfio-user hw/vfio-user: fix use of uninitialized variable 2025-07-15 17:11:12 +02:00
virtio virtio: fix off-by-one and invalid access in virtqueue_ordered_fill 2025-08-01 08:32:36 -04:00
vmapple qemu: Declare all load/store helper in 'qemu/bswap.h' 2025-07-15 02:56:39 -04:00
watchdog qom: Make InterfaceInfo[] uses const 2025-04-25 17:00:41 +02:00
xen hw/xen/passthrough: add missing error-report include 2025-07-29 13:56:39 +02:00
xenpv
xtensa qom: Have class_init() take a const data argument 2025-04-25 17:00:41 +02:00
Kconfig vfio-user: add vfio-user class and container 2025-06-26 08:55:38 +02:00
meson.build vfio-user: add vfio-user class and container 2025-06-26 08:55:38 +02:00