From 293084a7196b1d7781b6fe19b24e85eb8b7f4de0 Mon Sep 17 00:00:00 2001 From: Yongji Xie Date: Fri, 19 Jan 2018 00:04:05 +0800 Subject: libvhost-user: Support across-memory-boundary access The sg list/indirect descriptor table may be contigious in GPA but not in HVA address space. But libvhost-user wasn't aware of that. This would cause out-of-bounds access. Even a malicious guest could use it to get information from the vhost-user backend. Introduce a plen parameter in vu_gpa_to_va() so we can handle this case, returning the actual mapped length. Signed-off-by: Yongji Xie Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Reviewed-by: Maxime Coquelin --- contrib/libvhost-user/libvhost-user.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'contrib/libvhost-user/libvhost-user.h') diff --git a/contrib/libvhost-user/libvhost-user.h b/contrib/libvhost-user/libvhost-user.h index f8a730b725..18f95f65d7 100644 --- a/contrib/libvhost-user/libvhost-user.h +++ b/contrib/libvhost-user/libvhost-user.h @@ -327,11 +327,12 @@ bool vu_dispatch(VuDev *dev); /** * vu_gpa_to_va: * @dev: a VuDev context + * @plen: guest memory size * @guest_addr: guest address * * Translate a guest address to a pointer. Returns NULL on failure. */ -void *vu_gpa_to_va(VuDev *dev, uint64_t guest_addr); +void *vu_gpa_to_va(VuDev *dev, uint64_t *plen, uint64_t guest_addr); /** * vu_get_queue: -- cgit v1.2.3-55-g7522