friedkiwi/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

virtio-gpu: Validate hostmem mapping offset

Browse Source 
Check hostmem mapping boundaries originated from guest.

Suggested-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Message-ID: <20260303151422.977399-16-dmitry.osipenko@collabora.com>
Message-ID: <20260304165043.1437519-18-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
This commit is contained in:
Dmitry Osipenko
2026-03-04 16:50:39 +00:00
committed by Alex Bennée
parent 276a6c2919
commit d0803a90c8
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
hw/display/virtio-gpu-virgl.c
View File

@@ -791,6 +791,7 @@ static void virgl_cmd_resource_map_blob(VirtIOGPU *g,
struct virtio_gpu_resource_map_blob mblob;
struct virtio_gpu_virgl_resource *res;
struct virtio_gpu_resp_map_info resp;
VirtIOGPUBase *b = VIRTIO_GPU_BASE(g);
int ret;
VIRTIO_GPU_FILL_CMD(mblob);
@@ -804,6 +805,15 @@ static void virgl_cmd_resource_map_blob(VirtIOGPU *g,
return;
}
if (mblob.offset + res->base.blob_size > b->conf.hostmem ||
mblob.offset + res->base.blob_size < mblob.offset) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: failed to map virgl resource: invalid offset\n",
__func__);
cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
return;
}
ret = virtio_gpu_virgl_map_resource_blob(g, res, mblob.offset);
if (ret) {
cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;