On Wed, Dec 11, 2024 at 1:34 PM Wafer <wa...@jaguarmicro.com> wrote:
>
> From: Wafer Xie <wa...@jaguarmicro.com>
>
> The virtio-1.2 specification writes:
>
> 2.7.6 The Virtqueue Available Ring:
> "idx field indicates where the driver would put the next descriptor entry
> in the ring (modulo the queue size). This starts at 0, and increases"
>
> The idx will increase from 0 to 0xFFFF and repeat,
> So idx may be less than last_avail_idx.
>
I don't get this change. If that happens the driver went buggy or
malicious and the next check nheads > vring.num should mark the vq as
buggy, isn't it?
> Fixes: 258dc7c96b ("virtio: sanity-check available index")
>
> Signed-off-by: Wafer Xie <wa...@jaguarmicro.com>
>
> --
> Changes in v2:
> -Modify the commit id of the fix.
> ---
> hw/virtio/virtio.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index a26f18908e..ae7d407113 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -3362,7 +3362,13 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int
> version_id)
> continue;
> }
>
> - nheads = vring_avail_idx(&vdev->vq[i]) -
> vdev->vq[i].last_avail_idx;
> + if (vring_avail_idx(&vdev->vq[i]) >= vdev->vq[i].last_avail_idx)
> {
> + nheads = vring_avail_idx(&vdev->vq[i]) -
> + vdev->vq[i].last_avail_idx;
> + } else {
> + nheads = UINT16_MAX - vdev->vq[i].last_avail_idx +
> + vring_avail_idx(&vdev->vq[i]) + 1;
> + }
> /* Check it isn't doing strange things with descriptor numbers.
> */
> if (nheads > vdev->vq[i].vring.num) {
> virtio_error(vdev, "VQ %d size 0x%x Guest index 0x%x "
> --
> 2.27.0
>
