hv: validate inputs in vpci_mmio_cfg_access
This function is registered as PCI MMIO configuration
access handler, which processes PCI configuration access
request from ACRN guest hence the inputs shall be validated
to avoid potential hypervisor crash when handling inputs
from malicious guests.
Acked-by: Eddie Dong
@@ -192,10 +192,17 @@ static int32_t vpci_mmio_cfg_access(struct io_request *io_req, void *private_dat
bdf.value = (uint16_t)((address - pci_mmcofg_base) >> 12U);
if (mmio->direction == ACRN_IOREQ_DIR_READ) {
- ret = vpci_read_cfg(vpci, bdf, reg_num, (uint32_t)mmio->size, (uint32_t *)&mmio->value);
+ uint32_t val = ~0U;
+
+ if (pci_is_valid_access(reg_num, (uint32_t)mmio->size)) {
+ ret = vpci_read_cfg(vpci, bdf, reg_num, (uint32_t)mmio->size, &val);
+ }
+ mmio->value = val;
} else {
+ if (pci_is_valid_access(reg_num, (uint32_t)mmio->size)) {
ret = vpci_write_cfg(vpci, bdf, reg_num, (uint32_t)mmio->size, (uint32_t)mmio->value);
}
+ }
return ret;
}
