virtio-gpu: Validate hostmem mapping offset
Check hostmem mapping boundaries originated from guest. Suggested-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp> Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Message-ID: <20260303151422.977399-16-dmitry.osipenko@collabora.com> Message-ID: <20260304165043.1437519-18-alex.bennee@linaro.org> Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Dmitry Osipenko committed
Mar 4, 2026 at 16:50 UTC
d0803a90c8fa54c3867ab1ae4b9aee7e57d2e0d2
1 file changed
+10
hw/display/virtio-gpu-virgl.c
+10
@@ -791,6 +791,7 @@ static void virgl_cmd_resource_map_blob(VirtIOGPU *g,
791
struct virtio_gpu_resource_map_blob mblob;
792
struct virtio_gpu_virgl_resource *res;
793
struct virtio_gpu_resp_map_info resp;
794
+ VirtIOGPUBase *b = VIRTIO_GPU_BASE(g);
795
int ret;
796
797
VIRTIO_GPU_FILL_CMD(mblob);
@@ -804,6 +805,15 @@ static void virgl_cmd_resource_map_blob(VirtIOGPU *g,
805
return;
806
}
807
808
+ if (mblob.offset + res->base.blob_size > b->conf.hostmem ||
809
+ mblob.offset + res->base.blob_size < mblob.offset) {
810
+ qemu_log_mask(LOG_GUEST_ERROR,
811
+ "%s: failed to map virgl resource: invalid offset\n",
812
+ __func__);
813
+ cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
814
+ return;
815
+ }
816
+
817
ret = virtio_gpu_virgl_map_resource_blob(g, res, mblob.offset);
818
if (ret) {
819
cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;