Revision 98f3488c1b6090024299f8d6362aa6aac03fe26d authored by Akihiko Odaki on 28 February 2024, 11:33:12 UTC, committed by Michael Tokarev on 13 March 2024, 18:52:34 UTC
nvme_sriov_pre_write_ctrl() used to directly inspect SR-IOV
configurations to know the number of VFs being disabled due to SR-IOV
configuration writes, but the logic was flawed and resulted in
out-of-bound memory access.
It assumed PCI_SRIOV_NUM_VF always has the number of currently enabled
VFs, but it actually doesn't in the following cases:
- PCI_SRIOV_NUM_VF has been set but PCI_SRIOV_CTRL_VFE has never been.
- PCI_SRIOV_NUM_VF was written after PCI_SRIOV_CTRL_VFE was set.
- VFs were only partially enabled because of realization failure.
It is a responsibility of pcie_sriov to interpret SR-IOV configurations
and pcie_sriov does it correctly, so use pcie_sriov_num_vfs(), which it
provides, to get the number of enabled VFs before and after SR-IOV
configuration writes.
Cc: qemu-stable@nongnu.org
Fixes: CVE-2024-26328
Fixes: 11871f53ef8e ("hw/nvme: Add support for the Virtualization Management command")
Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20240228-reuse-v8-1-282660281e60@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 91bb64a8d2014fda33a81fcf0fce37340f0d3b0c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
1 parent 3097bcb
| File | Mode | Size |
|---|---|---|
| baum.c | -rw-r--r-- | 22.7 KB |
| char-console.c | -rw-r--r-- | 1.9 KB |
| char-fd.c | -rw-r--r-- | 6.9 KB |
| char-fe.c | -rw-r--r-- | 9.4 KB |
| char-file.c | -rw-r--r-- | 4.2 KB |
| char-hmp-cmds.c | -rw-r--r-- | 5.5 KB |
| char-io.c | -rw-r--r-- | 4.3 KB |
| char-mux.c | -rw-r--r-- | 12.0 KB |
| char-null.c | -rw-r--r-- | 1.8 KB |
| char-parallel.c | -rw-r--r-- | 8.5 KB |
| char-pipe.c | -rw-r--r-- | 5.6 KB |
| char-pty.c | -rw-r--r-- | 9.6 KB |
| char-ringbuf.c | -rw-r--r-- | 6.8 KB |
| char-serial.c | -rw-r--r-- | 8.5 KB |
| char-socket.c | -rw-r--r-- | 47.6 KB |
| char-stdio.c | -rw-r--r-- | 4.6 KB |
| char-udp.c | -rw-r--r-- | 7.1 KB |
| char-win-stdio.c | -rw-r--r-- | 8.1 KB |
| char-win.c | -rw-r--r-- | 6.4 KB |
| char.c | -rw-r--r-- | 32.5 KB |
| chardev-internal.h | -rw-r--r-- | 2.4 KB |
| meson.build | -rw-r--r-- | 1.1 KB |
| msmouse.c | -rw-r--r-- | 9.0 KB |
| spice.c | -rw-r--r-- | 10.6 KB |
| testdev.c | -rw-r--r-- | 3.6 KB |
| trace-events | -rw-r--r-- | 659 bytes |
| trace.h | -rw-r--r-- | 33 bytes |
| wctablet.c | -rw-r--r-- | 10.3 KB |
Computing file changes ...
