« Previous | Next » 

Revision 7157e2e2

ID7157e2e23e89adcd436caeab31fdd6b47eded377

Added by Stefan Hajnoczi almost 10 years ago

virtio: guard against negative vq notifies

The virtio_queue_notify() function checks that the virtqueue number is
less than the maximum number of virtqueues. A signed comparison is used
but the virtqueue number could be negative if a buggy or malicious guest
is run. This results in memory accesses outside of the virtqueue array.

It is risky doing input validation in common code instead of at the
guest<->host boundary. Note that virtio_queue_set_addr(),
virtio_queue_get_addr(), virtio_queue_get_num(), and many other virtio
functions do not validate the virtqueue number argument.

Instead of fixing the comparison in virtio_queue_notify(), move the
comparison to the virtio bindings (just like VIRTIO_PCI_QUEUE_SEL) where
we have a uint32_t value and can avoid ever calling into common virtio
code if the virtqueue number is invalid.

Signed-off-by: Stefan Hajnoczi <>
Signed-off-by: Michael S. Tsirkin <>

Files

  • added
  • modified
  • copied
  • renamed
  • deleted

View differences