Page MenuHomeFreeBSD

bhyve: Do not panic on invalid input in HDA emulation
ClosedPublic

Authored by christos on Fri, Aug 21, 3:02 PM.
Tags
None
Referenced Files
F171828602: D59082.diff
Sun, Sep 13, 9:04 PM
F171787686: D59082.id.diff
Sun, Sep 13, 12:59 PM
Unknown Object (File)
Fri, Sep 11, 7:23 PM
Unknown Object (File)
Fri, Sep 11, 6:00 PM
Unknown Object (File)
Thu, Sep 10, 10:24 PM
Unknown Object (File)
Thu, Sep 10, 7:29 PM
Unknown Object (File)
Tue, Sep 8, 2:15 PM
Unknown Object (File)
Tue, Sep 8, 12:40 PM

Details

Summary

The emulated HDA controller passed values taken from guest registers and
from guest memory straight into assert(), so a guest could abort bhyve
with values the emulation did not expect. Reject them instead.

In case the guest asked to start something and it failed, clear the
corresponding run/enable bit.

PR: 256379, 256381, 256382, 256383, 256384, 256385, 256386, 256498
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

bnovkov added inline comments.
usr.sbin/bhyve/pci_hda.c
812–814

Is it safe to continue executing after this fails?

813
966

There's a bunch of other typos like this.

usr.sbin/bhyve/pci_hda.c
812–814

Is it safe to continue executing after this fails?

Yes. This code path is called before any work is being done, and verb failures are not necessarily fatal errors. In snd_hda(4), hdac_send_command() does something similar for instance.

966

I know. I kept the same mistake for uniformity than cluttering the commit with these fixes.

Thanks for fixing these.

usr.sbin/bhyve/pci_hda.c
646–649

Maybe fix this to be ((bdle_sz % HDA_DMA_ACCESS_LEN) != 0)? Or alternatively if it isn't too tortured use __is_aligned() from <sys/cdefs.h> (that might be more readable)

This revision is now accepted and ready to land.Fri, Aug 21, 4:19 PM
bnovkov added inline comments.
usr.sbin/bhyve/pci_hda.c
966

got it, thanks.