kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio-devices: balloon: Cap inflate and deflate descriptor length

Browse Source 
Drop inflate or deflate descriptors whose len exceeds the Linux
driver maximum of VIRTIO_BALLOON_ARRAY_PFNS_MAX PFN entries of 4
bytes each. Without the cap, a guest can submit a descriptor with
a huge len over a small backing and drive an unbounded warn loop
in the device thread.

Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
This commit is contained in:
Anatol Belski
2026-05-08 23:11:43 +02:00
committed by Rob Bradford
parent bad10f3026
commit cfec130772
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
virtio-devices/src/balloon.rs
View File

@@ -59,6 +59,12 @@ const REPORTING_QUEUE_EVENT: u16 = EPOLL_HELPER_EVENT_LAST + 3;
// Size of a PFN in the balloon interface.
const VIRTIO_BALLOON_PFN_SHIFT: u64 = 12;
// Upper bound on a single inflate or deflate descriptor length, in
// bytes. Matches the Linux driver, which submits at most
// VIRTIO_BALLOON_ARRAY_PFNS_MAX of 256 PFN entries of 4 bytes each per
// descriptor.
const VIRTIO_BALLOON_MAX_PFN_BYTES: u32 = 256 * 4;
// Deflate balloon on OOM
const VIRTIO_BALLOON_F_DEFLATE_ON_OOM: u64 = 2;
// Enable an additional virtqueue to let the guest notify the host about free
@@ -282,6 +288,13 @@ impl BalloonEpollHandler {
);
continue;
}
if desc.len() > VIRTIO_BALLOON_MAX_PFN_BYTES {
warn!(
"Skipping descriptor with length {} exceeding cap {VIRTIO_BALLOON_MAX_PFN_BYTES}",
desc.len()
);
continue;
}
let mut offset = 0u64;
while offset < desc.len() as u64 {