From 795e606183d9cc11dd54b7ffd4c9425a25b660f9 Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Wed, 13 May 2026 16:30:34 +0200 Subject: [PATCH] virtio-devices: mem: Validate descriptor ranges Add check_range calls on request and status descriptor addresses to reject buffers that extend past guest memory. Signed-off-by: Anatol Belski --- virtio-devices/src/mem.rs | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/virtio-devices/src/mem.rs b/virtio-devices/src/mem.rs index 0cf477a31..244cc8c85 100644 --- a/virtio-devices/src/mem.rs +++ b/virtio-devices/src/mem.rs @@ -30,7 +30,7 @@ use thiserror::Error; use virtio_queue::{DescriptorChain, Queue, QueueT}; use vm_device::dma_mapping::ExternalDmaMapping; use vm_memory::{ - Address, ByteValued, Bytes, GuestAddress, GuestAddressSpace, GuestMemoryAtomic, + Address, ByteValued, Bytes, GuestAddress, GuestAddressSpace, GuestMemory, GuestMemoryAtomic, GuestMemoryError, GuestMemoryLoadGuard, GuestMemoryRegion, }; use vm_migration::protocol::MemoryRangeTable; @@ -284,6 +284,14 @@ impl Request { if (desc.len() as usize) < size_of::() { return Err(Error::InvalidRequest); } + if !desc_chain + .memory() + .check_range(desc.addr(), desc.len() as usize) + { + return Err(Error::GuestMemory(GuestMemoryError::InvalidGuestAddress( + desc.addr(), + ))); + } let req: VirtioMemReq = desc_chain .memory() .read_obj(desc.addr()) @@ -300,6 +308,15 @@ impl Request { return Err(Error::BufferLengthTooSmall); } + if !desc_chain + .memory() + .check_range(status_desc.addr(), status_desc.len() as usize) + { + return Err(Error::GuestMemory(GuestMemoryError::InvalidGuestAddress( + status_desc.addr(), + ))); + } + Ok(Request { req, status_addr: status_desc.addr(),