google / alioth / 42723368780

40%

Build Type

push

github

Committed by Lencerf

Commit Message

fix(virtio): limit packed indirect tables to the queue size

PackedQueue::get_avail() takes every descriptor in an indirect table,
whose length comes from the guest, and accepts an indirect descriptor
at each descriptor of a list. With a list of indirect descriptors
referring to a large table, a guest could make the device worker spend
CPU time and host memory far beyond the size of the guest memory.

An indirect descriptor cannot be in a list (VirtIO spec 1.4, Sec
2.8.19), so reject it there. The same section lets the device decide
the maximum length of a chain; like a split queue, limit an indirect
table to the queue size.

Fixes: f97eb722e6fa ("feat(virtio): support packed queue")
Signed-off-by: Changyuan Lyu <changyuanl@google.com>

Coverage Stats

876 of 1686 branches covered (51.96%)

Branch coverage included in aggregate %.

8 of 8 new or added lines in 1 file covered. (100.0%)

2 existing lines in 1 file now uncovered.

6250 of 16256 relevant lines covered (38.45%)

903.38 hits per line