]> git.ipfire.org Git - thirdparty/qemu.git/commit
hw/pvrdma: Protect against buggy or malicious guest driver
authorYuval Shaia <yuval.shaia.ml@gmail.com>
Wed, 1 Mar 2023 14:29:26 +0000 (16:29 +0200)
committerMichael Tokarev <mjt@tls.msk.ru>
Sat, 21 Oct 2023 11:05:14 +0000 (14:05 +0300)
commit06c9bf032f5581629819affd95fcbd7c54cf493a
tree478d112d14f7793807cee9c022dfbc0196c40f54
parent0c049eafd5a76e25ffe842d4eb4bb4f4d4919f5c
hw/pvrdma: Protect against buggy or malicious guest driver

Guest driver allocates and initialize page tables to be used as a ring
of descriptors for CQ and async events.
The page table that represents the ring, along with the number of pages
in the page table is passed to the device.
Currently our device supports only one page table for a ring.

Let's make sure that the number of page table entries the driver
reports, do not exceeds the one page table size.

Reported-by: Soul Chen <soulchen8650@gmail.com>
Signed-off-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
Fixes: CVE-2023-1544
Message-ID: <20230301142926.18686-1-yuval.shaia.ml@gmail.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 85fc35afa93c7320d1641d344d0c5dfbe341d087)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
hw/rdma/vmw/pvrdma_main.c