From cfec13077299eacd9d72bf8e64907ad8ea6c5ebe Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Fri, 8 May 2026 23:11:43 +0200 Subject: [PATCH] virtio-devices: balloon: Cap inflate and deflate descriptor length Drop inflate or deflate descriptors whose len exceeds the Linux driver maximum of VIRTIO_BALLOON_ARRAY_PFNS_MAX PFN entries of 4 bytes each. Without the cap, a guest can submit a descriptor with a huge len over a small backing and drive an unbounded warn loop in the device thread. Signed-off-by: Anatol Belski --- virtio-devices/src/balloon.rs | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/virtio-devices/src/balloon.rs b/virtio-devices/src/balloon.rs index 60c8c21c6..a1e624491 100644 --- a/virtio-devices/src/balloon.rs +++ b/virtio-devices/src/balloon.rs @@ -59,6 +59,12 @@ const REPORTING_QUEUE_EVENT: u16 = EPOLL_HELPER_EVENT_LAST + 3; // Size of a PFN in the balloon interface. const VIRTIO_BALLOON_PFN_SHIFT: u64 = 12; +// Upper bound on a single inflate or deflate descriptor length, in +// bytes. Matches the Linux driver, which submits at most +// VIRTIO_BALLOON_ARRAY_PFNS_MAX of 256 PFN entries of 4 bytes each per +// descriptor. +const VIRTIO_BALLOON_MAX_PFN_BYTES: u32 = 256 * 4; + // Deflate balloon on OOM const VIRTIO_BALLOON_F_DEFLATE_ON_OOM: u64 = 2; // Enable an additional virtqueue to let the guest notify the host about free @@ -282,6 +288,13 @@ impl BalloonEpollHandler { ); continue; } + if desc.len() > VIRTIO_BALLOON_MAX_PFN_BYTES { + warn!( + "Skipping descriptor with length {} exceeding cap {VIRTIO_BALLOON_MAX_PFN_BYTES}", + desc.len() + ); + continue; + } let mut offset = 0u64; while offset < desc.len() as u64 {