Revision 98f3488c1b6090024299f8d6362aa6aac03fe26d authored by Akihiko Odaki on 28 February 2024, 11:33:12 UTC, committed by Michael Tokarev on 13 March 2024, 18:52:34 UTC
nvme_sriov_pre_write_ctrl() used to directly inspect SR-IOV configurations to know the number of VFs being disabled due to SR-IOV configuration writes, but the logic was flawed and resulted in out-of-bound memory access. It assumed PCI_SRIOV_NUM_VF always has the number of currently enabled VFs, but it actually doesn't in the following cases: - PCI_SRIOV_NUM_VF has been set but PCI_SRIOV_CTRL_VFE has never been. - PCI_SRIOV_NUM_VF was written after PCI_SRIOV_CTRL_VFE was set. - VFs were only partially enabled because of realization failure. It is a responsibility of pcie_sriov to interpret SR-IOV configurations and pcie_sriov does it correctly, so use pcie_sriov_num_vfs(), which it provides, to get the number of enabled VFs before and after SR-IOV configuration writes. Cc: qemu-stable@nongnu.org Fixes: CVE-2024-26328 Fixes: 11871f53ef8e ("hw/nvme: Add support for the Virtualization Management command") Suggested-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com> Message-Id: <20240228-reuse-v8-1-282660281e60@daynix.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> (cherry picked from commit 91bb64a8d2014fda33a81fcf0fce37340f0d3b0c) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
1 parent 3097bcb
File | Mode | Size |
---|---|---|
QemuMacDrivers @ 90c488d | ||
SLOF @ 3a259df | ||
edk2 @ edc6681 | ||
ipxe @ 4bd064d | ||
openbios @ af97fd7 | ||
opensbi @ 057eb10 | ||
qboot @ 8ca302e | ||
qemu-palcode @ 99d9b4d | ||
seabios @ a6ed6b7 | ||
seabios-hppa @ e4eac85 | ||
skiboot @ 24a7eb3 | ||
u-boot @ 840658b | ||
u-boot-sam460ex @ 60b3916 | ||
vbootrom @ 0c37a43 | ||
Makefile | -rw-r--r-- | 6.9 KB |
config.seabios-128k | -rw-r--r-- | 554 bytes |
config.seabios-256k | -rw-r--r-- | 88 bytes |
config.seabios-microvm | -rw-r--r-- | 460 bytes |
config.vga-ati | -rw-r--r-- | 71 bytes |
config.vga-bochs-display | -rw-r--r-- | 63 bytes |
config.vga-cirrus | -rw-r--r-- | 60 bytes |
config.vga-isavga | -rw-r--r-- | 59 bytes |
config.vga-qxl | -rw-r--r-- | 128 bytes |
config.vga-ramfb | -rw-r--r-- | 59 bytes |
config.vga-stdvga | -rw-r--r-- | 59 bytes |
config.vga-virtio | -rw-r--r-- | 128 bytes |
config.vga-vmware | -rw-r--r-- | 128 bytes |
configure-seabios.sh | -rwxr-xr-x | 111 bytes |
edk2-build.config | -rw-r--r-- | 3.4 KB |
edk2-build.py | -rwxr-xr-x | 15.5 KB |
Computing file changes ...