d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
3d3678627c
freebsd-nq/usr.sbin/bhyve
History
Chuck Tuffli 3d3678627c bhyve nvme: Check return value of mapped memory 
Fuzzing of bhyve using hyfuzz discovered a way to cause a segmentation
fault in the NVMe emulation. If a guest specifies a physical address in
either the PRP1 or PRP2 field of a command that cannot be mapped from
guest to host, the function paddr_guest2host() returns a NULL pointer.
The NVMe emulation did not check for this error case, which allowed for
the segmentation fault to occur.

Fix is to check for a return value of NULL and indicate an error back to
the guest (Data Transfer error). While in the area, slightly refactor
the write/read blockif function to use a common error exit path.

PR:		256321
Reported by:	Cheolwoo Myung <cwmyung@snu.ac.kr>
Reviewed by:	imp, jhb
Differential Revision:	https://reviews.freebsd.org/D35452
2022-08-14 07:45:21 -07:00
..
kbdlayout pkgbase: bhyve: Tag the kbdlayout file to be in the bhyve package 2022-01-26 19:32:19 +01:00
acpi.c bhyve: Make the MADT dynamically sized. 2022-03-09 15:38:58 -08:00
acpi.h bhyve(8): Add VM Generation Counter ACPI device 2020-04-15 02:00:17 +00:00
ahci.h
atkbdc.c Initial support for bhyve save and restore. 2020-05-05 00:02:04 +00:00
atkbdc.h Initial support for bhyve save and restore. 2020-05-05 00:02:04 +00:00
audio.c
audio.h bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
bhyve_config.5 bhyve: Document the "type" config variable for network device models. 2022-06-30 15:14:36 -07:00
bhyve.8 bhyve.8: Fix a typo 2022-03-10 17:46:43 +01:00
bhyvegc.c
bhyvegc.h
bhyverun.c bhyve: Report an error for invalid UUIDs. 2022-06-16 13:18:01 -07:00
bhyverun.h Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
block_if.c bhyve: Snapshot impovements for 'blockif' backend 2022-06-23 11:46:06 -07:00
block_if.h bhyve: Snapshot impovements for 'blockif' backend 2022-06-23 11:46:06 -07:00
bootrom.c bhyve: add varfile option to nvlist of lpc device 2022-03-02 22:50:24 -09:00
bootrom.h bhyve: add varfile option to nvlist of lpc device 2022-03-02 22:50:24 -09:00
config.c bhyve: add nvlist functions for setting unset nodes 2022-01-14 12:41:44 +01:00
config.h bhyve: add nvlist functions for setting unset nodes 2022-01-14 12:41:44 +01:00
console.c Append Keyboard Layout specified option for using VNC. 2021-04-21 12:40:44 +02:00
console.h Append Keyboard Layout specified option for using VNC. 2021-04-21 12:40:44 +02:00
debug.h
fwctl.c bhyve: dynamically register FwCtl ports 2022-01-03 16:32:55 +01:00
fwctl.h
gdb.c bhyve: Fix getaddrinfo() error handling 2022-02-08 12:40:41 -05:00
gdb.h byhve: add option to specify IP address for gdb 2021-08-21 19:43:17 +02:00
hda_codec.c Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
hda_reg.h bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
hdac_reg.h
inout.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
inout.h bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
ioapic.c
ioapic.h
iov.c bhyve: enable virtio-net mergeable rx buffers for tap(4) 2020-02-20 21:07:23 +00:00
iov.h bhyve: enable virtio-net mergeable rx buffers for tap(4) 2020-02-20 21:07:23 +00:00
ipc.h bhyve: use linker set for ipc commands 2022-04-09 18:46:00 -08:00
kernemu_dev.c vmm(4), bhyve(8): Expose kernel-emulated special devices to userspace 2020-05-15 15:54:22 +00:00
kernemu_dev.h vmm(4), bhyve(8): Expose kernel-emulated special devices to userspace 2020-05-15 15:54:22 +00:00
Makefile Append Keyboard Layout specified option for using VNC. 2022-01-20 23:49:27 +01:00
Makefile.depend Initial support for bhyve save and restore. 2020-05-05 00:02:04 +00:00
Makefile.depend.options
mem.c bhyve: Allocate mmio_hint array based on number of guest CPUs. 2022-03-09 15:38:49 -08:00
mem.h bhyve: Allocate mmio_hint array based on number of guest CPUs. 2022-03-09 15:38:49 -08:00
mevent_test.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
mevent.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
mevent.h bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
mptbl.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
mptbl.h
net_backends.c bhyve virtio-net: Allow backend type to be explicitly specified. 2022-06-30 10:29:45 -07:00
net_backends.h Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
net_utils.c Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
net_utils.h Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
pci_ahci.c bhyve: Snapshot impovements for 'blockif' backend 2022-06-23 11:46:06 -07:00
pci_e82545.c bhyve: validate e82545 checksum offset field 2022-04-05 22:58:28 +00:00
pci_emul.c bhyve: avoid uninitialized variable 2022-04-01 11:13:16 +02:00
pci_emul.h bhyve: add ROM emulation 2022-03-10 12:30:37 +01:00
pci_fbuf.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
pci_hda.c Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
pci_hda.h bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
pci_hostbridge.c bhyve hostbridge: Rename "device" property to "devid". 2021-03-24 09:29:15 -07:00
pci_irq.c
pci_irq.h
pci_lpc.c bhyve: add varfile option to nvlist of lpc device 2022-03-02 22:50:24 -09:00
pci_lpc.h
pci_nvme.c bhyve nvme: Check return value of mapped memory 2022-08-14 07:45:21 -07:00
pci_passthru.c bhyve: fix spelling mistake in passthru emulation 2022-07-27 18:20:47 +02:00
pci_passthru.h bhyve: export funcs for read/write pci config 2022-03-10 12:30:02 +01:00
pci_uart.c Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
pci_virtio_9p.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
pci_virtio_block.c bhyve: Enable suspend/resume support for virtio-blk. 2022-06-23 11:46:06 -07:00
pci_virtio_console.c bhyve: Fix virtio-console legacy configuration parsing 2022-05-06 15:34:17 -04:00
pci_virtio_input.c Add a virtio-input device emulation. 2021-06-08 19:05:09 +10:00
pci_virtio_net.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
pci_virtio_rnd.c bhyve: missing mutex initializations 2022-03-15 19:54:16 -08:00
pci_virtio_scsi.c bhyve: missing mutex initializations 2022-03-15 19:54:16 -08:00
pci_xhci.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
pci_xhci.h
pctestdev.c Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
pctestdev.h Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
pm.c Silence ACPI RTC error/warning in Linux guests. 2020-07-06 08:36:14 +00:00
post.c
ps2kbd.c Append Keyboard Layout specified option for using VNC. 2022-01-20 23:49:27 +01:00
ps2kbd.h Initial support for bhyve save and restore. 2020-05-05 00:02:04 +00:00
ps2mouse.c Initial support for bhyve save and restore. 2020-05-05 00:02:04 +00:00
ps2mouse.h bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
rfb.c Append Keyboard Layout specified option for using VNC. 2021-04-21 12:40:44 +02:00
rfb.h
rtc.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
rtc.h Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
smbiostbl.c bhyve: Report an error for invalid UUIDs. 2022-06-16 13:18:01 -07:00
smbiostbl.h
snapshot.c bhyve/snapshot: ..back to SOCK_STREAM 2022-04-28 07:43:01 -08:00
snapshot.h bhyve/snapshot: use a string for cmd element in the nvlist 2022-02-15 08:12:15 -09:00
sockstream.c
sockstream.h
spinup_ap.c
spinup_ap.h
task_switch.c
uart_emul.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
uart_emul.h Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
usb_emul.c Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
usb_emul.h Refactor configuration management in bhyve. 2021-03-18 16:30:26 -07:00
usb_mouse.c bhyve: clean up trailing whitespaces 2021-12-27 19:58:10 +02:00
vga.c
vga.h
virtio.c bhyve: Only snapshot initialized VirtIO queues 2021-12-17 13:06:53 -05:00
virtio.h bhyve/virtio: use correct device id for virtio-scsi 2022-01-31 09:44:47 -09:00
vmgenc.c bhyve(8): Correct copyright boilerplate for r359950 2020-04-15 05:55:14 +00:00
vmgenc.h bhyve(8): Correct copyright boilerplate for r359950 2020-04-15 05:55:14 +00:00
xmsr.c bhyve: implement rdmsr for MSR_IA32_FEATURE_CONTROL 2021-04-15 13:49:19 +10:00
xmsr.h