ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

hw/vfio/pci-quirks: Sanitize capability pointer 

Coverity reports a tained scalar when traversing the capabilities
chain (CID 1516589).  In practice I've never seen a device with a
chain so broken as to cause an issue, but it's also pretty easy to
sanitize.

Fixes: f6b30c1984 ("hw/vfio/pci-quirks: Support alternate offset for GPUDirect Cliques")
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
This commit is contained in:
Alex Williamson 2023-06-30 16:36:08 -06:00 committed by Cédric Le Goater
parent 2ff49e96ac
commit 0ddcb39c93
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
hw/vfio/pci-quirks.c
View File

@ -1530,6 +1530,12 @@ const PropertyInfo qdev_prop_nv_gpudirect_clique = {
.set = set_nv_gpudirect_clique_id, .set = set_nv_gpudirect_clique_id,
}; };
static bool is_valid_std_cap_offset(uint8_t pos)
{
return (pos >= PCI_STD_HEADER_SIZEOF &&
pos <= (PCI_CFG_SPACE_SIZE - PCI_CAP_SIZEOF));
}
static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp) static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
{ {
PCIDevice *pdev = &vdev->pdev; PCIDevice *pdev = &vdev->pdev;
@ -1563,7 +1569,7 @@ static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
*/ */
ret = pread(vdev->vbasedev.fd, &tmp, 1, ret = pread(vdev->vbasedev.fd, &tmp, 1,
vdev->config_offset + PCI_CAPABILITY_LIST); vdev->config_offset + PCI_CAPABILITY_LIST);
if (ret != 1 || !tmp) { if (ret != 1 || !is_valid_std_cap_offset(tmp)) {
error_setg(errp, "NVIDIA GPUDirect Clique ID: error getting cap list"); error_setg(errp, "NVIDIA GPUDirect Clique ID: error getting cap list");
return -EINVAL; return -EINVAL;
} }
@ -1575,7 +1581,7 @@ static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
d4_conflict = true; d4_conflict = true;
} }
tmp = pdev->config[tmp + PCI_CAP_LIST_NEXT]; tmp = pdev->config[tmp + PCI_CAP_LIST_NEXT];
} while (tmp); } while (is_valid_std_cap_offset(tmp));
if (!c8_conflict) { if (!c8_conflict) {
pos = 0xC8; pos = 0xC8;