Skip to main content

Browse the archive

Revision 98f3488c1b6090024299f8d6362aa6aac03fe26d authored by Akihiko Odaki on 28 February 2024, 11:33:12 UTC, committed by Michael Tokarev on 13 March 2024, 18:52:34 UTC 
hw/nvme: Use pcie_sriov_num_vfs()
 
nvme_sriov_pre_write_ctrl() used to directly inspect SR-IOV
configurations to know the number of VFs being disabled due to SR-IOV
configuration writes, but the logic was flawed and resulted in
out-of-bound memory access.

It assumed PCI_SRIOV_NUM_VF always has the number of currently enabled
VFs, but it actually doesn't in the following cases:
- PCI_SRIOV_NUM_VF has been set but PCI_SRIOV_CTRL_VFE has never been.
- PCI_SRIOV_NUM_VF was written after PCI_SRIOV_CTRL_VFE was set.
- VFs were only partially enabled because of realization failure.

It is a responsibility of pcie_sriov to interpret SR-IOV configurations
and pcie_sriov does it correctly, so use pcie_sriov_num_vfs(), which it
provides, to get the number of enabled VFs before and after SR-IOV
configuration writes.

Cc: qemu-stable@nongnu.org
Fixes: CVE-2024-26328
Fixes: 11871f53ef8e ("hw/nvme: Add support for the Virtualization Management command")
Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Message-Id: <20240228-reuse-v8-1-282660281e60@daynix.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit 91bb64a8d2014fda33a81fcf0fce37340f0d3b0c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
1 parent 3097bcb
Raw File
version.rc 
#include <winver.h>
#include "config-host.h"

VS_VERSION_INFO VERSIONINFO
FILEVERSION QEMU_VERSION_MAJOR,QEMU_VERSION_MINOR,QEMU_VERSION_MICRO,0
PRODUCTVERSION QEMU_VERSION_MAJOR,QEMU_VERSION_MINOR,QEMU_VERSION_MICRO,0
FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
FILEOS VOS_NT_WINDOWS32
FILETYPE VFT_APP
FILESUBTYPE VFT2_UNKNOWN
{
  BLOCK "StringFileInfo"
  {
    BLOCK "040904E4"
    {
      VALUE "CompanyName", "https://www.qemu.org"
      VALUE "FileDescription", "QEMU machine emulators and tools"
      VALUE "FileVersion", QEMU_VERSION
      VALUE "LegalCopyright", "Copyright various authors. Released under the GNU General Public License."
      VALUE "LegalTrademarks", "QEMU is a trademark of Fabrice Bellard."
      VALUE "ProductName", "QEMU"
    }
  }
  BLOCK "VarFileInfo"
  {
    VALUE "Translation", 0x0409, 1252
  }
}

IDI_ICON1 ICON "pc-bios/qemu-nsis.ico"
back to top