kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio-devices: vdpa: checked arithmetic in dma_unmap

Browse Source 
dma_unmap computed `iova + size - 1` unchecked while the sibling dma_map
already used checked_add/checked_sub. A guest reaching dma_unmap via
VIRTIO_IOMMU_T_UNMAP could cause a panic.

Signed-off-by: Dylan Reid <dgreid@fb.com>
This commit is contained in:
Dylan Reid
2026-04-24 16:57:24 -07:00
committed by Rob Bradford
parent 5b199498ff
commit 02b503ee16
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
virtio-devices/src/vdpa.rs
View File

@@ -365,7 +365,12 @@ impl Vdpa {
} }
fn dma_unmap(&self, iova: u64, size: u64) -> Result<()> { fn dma_unmap(&self, iova: u64, size: u64) -> Result<()> {
let iova_last = iova + size - 1; let Some(iova_last) = iova.checked_add(size) else {
return Err(Error::InvalidIovaRange(iova, u64::MAX));
};
let Some(iova_last) = iova_last.checked_sub(1) else {
return Err(Error::InvalidIovaRange(0, 0));
};
if iova < self.iova_range.first || iova_last > self.iova_range.last { if iova < self.iova_range.first || iova_last > self.iova_range.last {
return Err(Error::InvalidIovaRange(iova, iova_last)); return Err(Error::InvalidIovaRange(iova, iova_last));
} }