After restoring a VirtQueueElement during migration, validate that iov_idx and iov_offset are within the bounds of the element's scatter-gather list. A corrupted migration stream could cause out-of-bounds access when the port is later unthrottled.
Reported-by: Pavee Hui <[email protected]> Signed-off-by: Marc-André Lureau <[email protected]> --- hw/char/virtio-serial-bus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c index c36e18a4cfb5..8b9d5f32dea6 100644 --- a/hw/char/virtio-serial-bus.c +++ b/hw/char/virtio-serial-bus.c @@ -768,6 +768,12 @@ static int fetch_active_ports_list(QEMUFile *f, error_report("Failed to restore virtio-serial element"); return -EINVAL; } + if (port->iov_idx >= port->elem->out_num || + port->iov_offset > port->elem->out_sg[port->iov_idx].iov_len) { + error_report("Invalid iov indexes"); + g_clear_pointer(&port->elem, g_free); + return -EINVAL; + } /* * Port was throttled on source machine. Let's -- 2.56.0.rc0.29.g47ce80527c56
