Date: Tue, 29 Oct 2024 18:49:52 GMT From: Ed Maste <emaste@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 1c48a9b47821 - releng/13.4 - bhyve: avoid TOCTOU on iov_len in virtio_vq_recordon() Message-ID: <202410291849.49TInq6T018548@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch releng/13.4 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=1c48a9b47821de7c4d0dbe28de112b525470e209 commit 1c48a9b47821de7c4d0dbe28de112b525470e209 Author: Pierre Pronchery <pierre@freebsdfoundation.org> AuthorDate: 2024-08-27 13:57:32 +0000 Commit: Ed Maste <emaste@FreeBSD.org> CommitDate: 2024-10-29 18:46:43 +0000 bhyve: avoid TOCTOU on iov_len in virtio_vq_recordon() Avoid a race condition when accessing guest memory, by reading memory contents only once. This has also been applied to _vq_record() in sys/dev/beri/virtio/virtio.c, as per markj@'s suggestion. Reported by: Synacktiv Reviewed by: markj Security: HYP-10 Security: FreeBSD-SA-24:17.bhyve Approved by: so Sponsored by: The Alpha-Omega Project Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D45735 (cherry picked from commit 869d760cb9d7a307faa2fbe8c1c2b238a81b74d4) (cherry picked from commit ed03c309908687bdb9f71dc6d9c9c8a92c54fc20) (cherry picked from commit 6eb7879f426129aa38f4e8b0d57ab7456e4eb351) --- sys/dev/beri/virtio/virtio.c | 11 ++++++++--- usr.sbin/bhyve/virtio.c | 9 +++++++-- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/sys/dev/beri/virtio/virtio.c b/sys/dev/beri/virtio/virtio.c index c249d1c9d37b..7302bc39d799 100644 --- a/sys/dev/beri/virtio/virtio.c +++ b/sys/dev/beri/virtio/virtio.c @@ -107,12 +107,17 @@ paddr_unmap(void *phys, uint32_t size) static inline void _vq_record(uint32_t offs, int i, volatile struct vring_desc *vd, struct iovec *iov, int n_iov, uint16_t *flags) { + uint32_t len; + uint64_t addr; + if (i >= n_iov) return; - iov[i].iov_base = paddr_map(offs, be64toh(vd->addr), - be32toh(vd->len)); - iov[i].iov_len = be32toh(vd->len); + len = atomic_load_32(&vd->len); + addr = atomic_load_64(&vd->addr); + iov[i].iov_base = paddr_map(offs, be64toh(addr), + be32toh(len)); + iov[i].iov_len = be32toh(len); if (flags != NULL) flags[i] = be16toh(vd->flags); } diff --git a/usr.sbin/bhyve/virtio.c b/usr.sbin/bhyve/virtio.c index 5294da670677..d11f5683e7b7 100644 --- a/usr.sbin/bhyve/virtio.c +++ b/usr.sbin/bhyve/virtio.c @@ -215,10 +215,15 @@ static inline void _vq_record(int i, struct vring_desc *vd, struct vmctx *ctx, struct iovec *iov, int n_iov, struct vi_req *reqp) { + uint32_t len; + uint64_t addr; + if (i >= n_iov) return; - iov[i].iov_base = paddr_guest2host(ctx, vd->addr, vd->len); - iov[i].iov_len = vd->len; + len = atomic_load_32(&vd->len); + addr = atomic_load_64(&vd->addr); + iov[i].iov_len = len; + iov[i].iov_base = paddr_guest2host(ctx, addr, len); if ((vd->flags & VRING_DESC_F_WRITE) == 0) reqp->readable++; else
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202410291849.49TInq6T018548>