Check hostmem mapping boundaries originated from guest.
Suggested-by: Akihiko Odaki <[email protected]>
Signed-off-by: Dmitry Osipenko <[email protected]>
---
hw/display/virtio-gpu-virgl.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index a6860f63b563..6a2aac0b6e5c 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -767,6 +767,7 @@ static void virgl_cmd_resource_map_blob(VirtIOGPU *g,
struct virtio_gpu_resource_map_blob mblob;
struct virtio_gpu_virgl_resource *res;
struct virtio_gpu_resp_map_info resp;
+ VirtIOGPUBase *b = VIRTIO_GPU_BASE(g);
int ret;
VIRTIO_GPU_FILL_CMD(mblob);
@@ -780,6 +781,15 @@ static void virgl_cmd_resource_map_blob(VirtIOGPU *g,
return;
}
+ if (mblob.offset + res->base.blob_size > b->conf.hostmem ||
+ mblob.offset + res->base.blob_size < mblob.offset) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: failed to map virgl resource: invalid offset\n",
+ __func__);
+ cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
+ return;
+ }
+
ret = virtio_gpu_virgl_map_resource_blob(g, res, mblob.offset);
if (ret) {
cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
--
2.51.1
