A malicious guest can exploit virtio-mem to release memory back to the hypervisor and attempt Rowhammer attacks. The only case reasonable for unplugging is when the size > requested_size.
Signed-off-by: Wei Chen <[email protected]> Signed-off-by: Zhi Zhang <[email protected]> --- hw/virtio/virtio-mem.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c index 80ada89551..4ef67082a2 100644 --- a/hw/virtio/virtio-mem.c +++ b/hw/virtio/virtio-mem.c @@ -671,6 +671,10 @@ static int virtio_mem_state_change_request(VirtIOMEM *vmem, uint64_t gpa, return VIRTIO_MEM_RESP_NACK; } + if (!plug && vmem->size <= vmem->requested_size) { + return VIRTIO_MEM_RESP_NACK; + } + /* test if really all blocks are in the opposite state */ if ((plug && !virtio_mem_is_range_unplugged(vmem, gpa, size)) || (!plug && !virtio_mem_is_range_plugged(vmem, gpa, size))) { -- 2.47.1
