google / alioth / 42707878325

40%

Build Type

push

github

Committed by Lencerf

Commit Message

fix(virtio): check whole packed virtqueue rings in guest memory

Like SplitQueue::new() did, PackedQueue::new() checks only the first
descriptor of the ring, but the queue accesses descriptors up to the
queue size. A driver that places the ring at the end of guest memory,
or across two memory regions, makes the worker read and write host
memory beyond the guest memory mapping.

Check that the whole ring is backed by one contiguous host mapping, and
reject queue sizes above 2^15, the maximum for packed virtqueues, which
is also all that the 15-bit ring offset in WrappedIndex can address.

Also stop at a descriptor chain as long as the ring, since a chain takes
consecutive descriptors. Otherwise, a driver that sets VIRTQ_DESC_F_NEXT
in every descriptor makes the worker loop forever, and a driver that
changes the flags while the worker walks the chain can end it after more
descriptors than the ring has, which moves the offset of the next chain
beyond the ring.

Fixes: f97eb722e6fa ("feat(virtio): support packed queue")
Signed-off-by: Changyuan Lyu <changyuanl@google.com>

Coverage Stats

858 of 1676 branches covered (51.19%)

Branch coverage included in aggregate %.

5 of 5 new or added lines in 1 file covered. (100.0%)

13 existing lines in 3 files now uncovered.

6216 of 16240 relevant lines covered (38.28%)

896.24 hits per line