Page MenuHomeFreeBSD

bhyve: check XHCI_GADDR return in command handlers
Needs ReviewPublic

Authored by ojanerif_amd.com on Mon, Oct 19, 5:51 PM.

Details

Reviewers
mhorne
markj
Group Reviewers
bhyve
Summary

pci_xhci_cmd_address_device(), pci_xhci_cmd_config_ep(), and
pci_xhci_cmd_eval_ctx() dereference XHCI_GADDR() without checking for
NULL. An invalid guest TRB address causes a NULL dereference in the bhyve
process. Return XHCI_TRB_ERROR_TRB on failure.

FreeBSD-SA-26:72.bhyve added NULL checks for TRB ring traversal but left
these three command handlers unguarded. Note that dev_ctx is already
checked for NULL in the same handlers.

Diff Detail

Lint
Lint Skipped
Unit
Tests Skipped