From nobody Mon Feb 9 13:38:10 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1518117851416599.7045479550997; Thu, 8 Feb 2018 11:24:11 -0800 (PST) Received: from localhost ([::1]:39167 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ejrnm-0002Cm-Hb for importer@patchew.org; Thu, 08 Feb 2018 14:24:10 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54273) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ejrZQ-0006Lg-GC for qemu-devel@nongnu.org; Thu, 08 Feb 2018 14:09:22 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ejrZN-0008QT-S5 for qemu-devel@nongnu.org; Thu, 08 Feb 2018 14:09:20 -0500 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:50912 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ejrZN-0008Q6-Md for qemu-devel@nongnu.org; Thu, 08 Feb 2018 14:09:17 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 597798182D2D; Thu, 8 Feb 2018 19:09:17 +0000 (UTC) Received: from redhat.com (ovpn-120-144.rdu2.redhat.com [10.10.120.144]) by smtp.corp.redhat.com (Postfix) with SMTP id F16D62024CA2; Thu, 8 Feb 2018 19:09:16 +0000 (UTC) Date: Thu, 8 Feb 2018 21:09:16 +0200 From: "Michael S. Tsirkin" To: qemu-devel@nongnu.org Message-ID: <1518116908-10852-22-git-send-email-mst@redhat.com> References: <1518116908-10852-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1518116908-10852-1-git-send-email-mst@redhat.com> X-Mutt-Fcc: =sent X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.8]); Thu, 08 Feb 2018 19:09:17 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.8]); Thu, 08 Feb 2018 19:09:17 +0000 (UTC) for IP:'10.11.54.4' DOMAIN:'int-mx04.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'mst@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PULL 21/26] libvhost-user: Support across-memory-boundary access X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , "Dr. David Alan Gilbert" , Philippe =?utf-8?Q?Mathieu-Daud=C3=A9?= , Yongji Xie , Maxime Coquelin , Paolo Bonzini , =?utf-8?Q?Marc-Andr=C3=A9?= Lureau , Yongji Xie Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Yongji Xie The sg list/indirect descriptor table may be contigious in GPA but not in HVA address space. But libvhost-user wasn't aware of that. This would cause out-of-bounds access. Even a malicious guest could use it to get information from the vhost-user backend. Introduce a plen parameter in vu_gpa_to_va() so we can handle this case, returning the actual mapped length. Signed-off-by: Yongji Xie Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Reviewed-by: Maxime Coquelin --- contrib/libvhost-user/libvhost-user.h | 3 +- contrib/libvhost-user/libvhost-user.c | 133 ++++++++++++++++++++++++++++++= ---- 2 files changed, 122 insertions(+), 14 deletions(-) diff --git a/contrib/libvhost-user/libvhost-user.h b/contrib/libvhost-user/= libvhost-user.h index f8a730b..18f95f6 100644 --- a/contrib/libvhost-user/libvhost-user.h +++ b/contrib/libvhost-user/libvhost-user.h @@ -327,11 +327,12 @@ bool vu_dispatch(VuDev *dev); /** * vu_gpa_to_va: * @dev: a VuDev context + * @plen: guest memory size * @guest_addr: guest address * * Translate a guest address to a pointer. Returns NULL on failure. */ -void *vu_gpa_to_va(VuDev *dev, uint64_t guest_addr); +void *vu_gpa_to_va(VuDev *dev, uint64_t *plen, uint64_t guest_addr); =20 /** * vu_get_queue: diff --git a/contrib/libvhost-user/libvhost-user.c b/contrib/libvhost-user/= libvhost-user.c index 54dbc93..2e358b5 100644 --- a/contrib/libvhost-user/libvhost-user.c +++ b/contrib/libvhost-user/libvhost-user.c @@ -118,15 +118,22 @@ vu_panic(VuDev *dev, const char *msg, ...) =20 /* Translate guest physical address to our virtual address. */ void * -vu_gpa_to_va(VuDev *dev, uint64_t guest_addr) +vu_gpa_to_va(VuDev *dev, uint64_t *plen, uint64_t guest_addr) { int i; =20 + if (*plen =3D=3D 0) { + return NULL; + } + /* Find matching memory region. */ for (i =3D 0; i < dev->nregions; i++) { VuDevRegion *r =3D &dev->regions[i]; =20 if ((guest_addr >=3D r->gpa) && (guest_addr < (r->gpa + r->size)))= { + if ((guest_addr + *plen) > (r->gpa + r->size)) { + *plen =3D r->gpa + r->size - guest_addr; + } return (void *)(uintptr_t) guest_addr - r->gpa + r->mmap_addr + r->mmap_offset; } @@ -1116,6 +1123,37 @@ virtqueue_get_head(VuDev *dev, VuVirtq *vq, return true; } =20 +static int +virtqueue_read_indirect_desc(VuDev *dev, struct vring_desc *desc, + uint64_t addr, size_t len) +{ + struct vring_desc *ori_desc; + uint64_t read_len; + + if (len > (VIRTQUEUE_MAX_SIZE * sizeof(struct vring_desc))) { + return -1; + } + + if (len =3D=3D 0) { + return -1; + } + + while (len) { + read_len =3D len; + ori_desc =3D vu_gpa_to_va(dev, &read_len, addr); + if (!ori_desc) { + return -1; + } + + memcpy(desc, ori_desc, read_len); + len -=3D read_len; + addr +=3D read_len; + desc +=3D read_len; + } + + return 0; +} + enum { VIRTQUEUE_READ_DESC_ERROR =3D -1, VIRTQUEUE_READ_DESC_DONE =3D 0, /* end of chain */ @@ -1162,8 +1200,10 @@ vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq, un= signed int *in_bytes, } =20 while ((rc =3D virtqueue_num_heads(dev, vq, idx)) > 0) { - unsigned int max, num_bufs, indirect =3D 0; + unsigned int max, desc_len, num_bufs, indirect =3D 0; + uint64_t desc_addr, read_len; struct vring_desc *desc; + struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; unsigned int i; =20 max =3D vq->vring.num; @@ -1187,8 +1227,24 @@ vu_queue_get_avail_bytes(VuDev *dev, VuVirtq *vq, un= signed int *in_bytes, =20 /* loop over the indirect descriptor table */ indirect =3D 1; - max =3D desc[i].len / sizeof(struct vring_desc); - desc =3D vu_gpa_to_va(dev, desc[i].addr); + desc_addr =3D desc[i].addr; + desc_len =3D desc[i].len; + max =3D desc_len / sizeof(struct vring_desc); + read_len =3D desc_len; + desc =3D vu_gpa_to_va(dev, &read_len, desc_addr); + if (unlikely(desc && read_len !=3D desc_len)) { + /* Failed to use zero copy */ + desc =3D NULL; + if (!virtqueue_read_indirect_desc(dev, desc_buf, + desc_addr, + desc_len)) { + desc =3D desc_buf; + } + } + if (!desc) { + vu_panic(dev, "Invalid indirect buffer table"); + goto err; + } num_bufs =3D i =3D 0; } =20 @@ -1386,9 +1442,24 @@ virtqueue_map_desc(VuDev *dev, return; } =20 - iov[num_sg].iov_base =3D vu_gpa_to_va(dev, pa); - iov[num_sg].iov_len =3D sz; - num_sg++; + while (sz) { + uint64_t len =3D sz; + + if (num_sg =3D=3D max_num_sg) { + vu_panic(dev, "virtio: too many descriptors in indirect table"= ); + return; + } + + iov[num_sg].iov_base =3D vu_gpa_to_va(dev, &len, pa); + if (iov[num_sg].iov_base =3D=3D NULL) { + vu_panic(dev, "virtio: invalid address for buffers"); + return; + } + iov[num_sg].iov_len =3D len; + num_sg++; + sz -=3D len; + pa +=3D len; + } =20 *p_num_sg =3D num_sg; } @@ -1420,10 +1491,12 @@ virtqueue_alloc_element(size_t sz, void * vu_queue_pop(VuDev *dev, VuVirtq *vq, size_t sz) { - unsigned int i, head, max; + unsigned int i, head, max, desc_len; + uint64_t desc_addr, read_len; VuVirtqElement *elem; unsigned out_num, in_num; struct iovec iov[VIRTQUEUE_MAX_SIZE]; + struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; struct vring_desc *desc; int rc; =20 @@ -1464,8 +1537,24 @@ vu_queue_pop(VuDev *dev, VuVirtq *vq, size_t sz) } =20 /* loop over the indirect descriptor table */ - max =3D desc[i].len / sizeof(struct vring_desc); - desc =3D vu_gpa_to_va(dev, desc[i].addr); + desc_addr =3D desc[i].addr; + desc_len =3D desc[i].len; + max =3D desc_len / sizeof(struct vring_desc); + read_len =3D desc_len; + desc =3D vu_gpa_to_va(dev, &read_len, desc_addr); + if (unlikely(desc && read_len !=3D desc_len)) { + /* Failed to use zero copy */ + desc =3D NULL; + if (!virtqueue_read_indirect_desc(dev, desc_buf, + desc_addr, + desc_len)) { + desc =3D desc_buf; + } + } + if (!desc) { + vu_panic(dev, "Invalid indirect buffer table"); + return NULL; + } i =3D 0; } =20 @@ -1541,7 +1630,9 @@ vu_log_queue_fill(VuDev *dev, VuVirtq *vq, unsigned int len) { struct vring_desc *desc =3D vq->vring.desc; - unsigned int i, max, min; + unsigned int i, max, min, desc_len; + uint64_t desc_addr, read_len; + struct vring_desc desc_buf[VIRTQUEUE_MAX_SIZE]; unsigned num_bufs =3D 0; =20 max =3D vq->vring.num; @@ -1553,8 +1644,24 @@ vu_log_queue_fill(VuDev *dev, VuVirtq *vq, } =20 /* loop over the indirect descriptor table */ - max =3D desc[i].len / sizeof(struct vring_desc); - desc =3D vu_gpa_to_va(dev, desc[i].addr); + desc_addr =3D desc[i].addr; + desc_len =3D desc[i].len; + max =3D desc_len / sizeof(struct vring_desc); + read_len =3D desc_len; + desc =3D vu_gpa_to_va(dev, &read_len, desc_addr); + if (unlikely(desc && read_len !=3D desc_len)) { + /* Failed to use zero copy */ + desc =3D NULL; + if (!virtqueue_read_indirect_desc(dev, desc_buf, + desc_addr, + desc_len)) { + desc =3D desc_buf; + } + } + if (!desc) { + vu_panic(dev, "Invalid indirect buffer table"); + return; + } i =3D 0; } =20 --=20 MST