kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

pci: msix: Replace panic with graceful error on invalid table write

Browse Source 
A malicious or buggy guest can issue an MSI-X table write with an
unexpected size (not 4 or 8 bytes), triggering an assert!() that
crashes the VMM process. Replace the assertion with an error log and
early return to maintain VMM stability under adversarial guest
behavior.

Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
This commit is contained in:
Anatol Belski
2026-05-04 11:43:36 +02:00
committed by Rob Bradford
parent c5951252a5
commit 7fbc5a1354
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
pci/src/msix.rs
View File

@@ -321,7 +321,13 @@ impl MsixConfig {
}
pub fn write_table(&mut self, offset: u64, data: &[u8]) {
assert!(data.len() == 4 || data.len() == 8);
if data.len() != 4 && data.len() != 8 {
error!(
"invalid MSI-X table write size: {} (allowed: 4 or 8)",
data.len()
);
return;
}
let index: usize = (offset / MSIX_TABLE_ENTRIES_MODULO) as usize;
let modulo_offset = offset % MSIX_TABLE_ENTRIES_MODULO;