38 lines
1.3 KiB
Diff
38 lines
1.3 KiB
Diff
|
From 632ec38ed57b76baf3e499d1789aeea0f74df0a5 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Akihiko Odaki <akihiko.odaki@daynix.com>
|
||
|
|
Date: Wed, 28 Feb 2024 20:33:13 +0900
|
||
|
|
Subject: [PATCH] pcie_sriov: Validate NumVFs (CVE-2024-26327)
|
||
|
|
|
||
|
|
The guest may write NumVFs greater than TotalVFs and that can lead
|
||
|
|
to buffer overflow in VF implementations.
|
||
|
|
|
||
|
|
Cc: qemu-stable@nongnu.org
|
||
|
|
Fixes: CVE-2024-26327
|
||
|
|
Fixes: 7c0fa8dff811 ("pcie: Add support for Single Root I/O Virtualization (SR/IOV)")
|
||
|
|
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
|
||
|
|
Message-Id: <20240228-reuse-v8-2-282660281e60@daynix.com>
|
||
|
|
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
||
|
|
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
||
|
|
Reviewed-by: Sriram Yagnaraman <sriram.yagnaraman@ericsson.com>
|
||
|
|
---
|
||
|
|
hw/pci/pcie_sriov.c | 3 +++
|
||
|
|
1 file changed, 3 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
|
||
|
|
index a1fe65f5d8..da209b7f47 100644
|
||
|
|
--- a/hw/pci/pcie_sriov.c
|
||
|
|
+++ b/hw/pci/pcie_sriov.c
|
||
|
|
@@ -176,6 +176,9 @@ static void register_vfs(PCIDevice *dev)
|
||
|
|
|
||
|
|
assert(sriov_cap > 0);
|
||
|
|
num_vfs = pci_get_word(dev->config + sriov_cap + PCI_SRIOV_NUM_VF);
|
||
|
|
+ if (num_vfs > pci_get_word(dev->config + sriov_cap + PCI_SRIOV_TOTAL_VF)) {
|
||
|
|
+ return;
|
||
|
|
+ }
|
||
|
|
|
||
|
|
dev->exp.sriov_pf.vf = g_new(PCIDevice *, num_vfs);
|
||
|
|
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|