git: a305f44d1404 - main - bhyve: validate corb->wp to avoid infinite loop

The branch main has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=a305f44d1404fbf386bb2b50ab7233ce9eabe0bb

commit a305f44d1404fbf386bb2b50ab7233ce9eabe0bb
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2024-09-19 18:57:42 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2024-09-22 11:25:02 +0000

    bhyve: validate corb->wp to avoid infinite loop
    
    Guests must set HDAC_CORBWP less than corb->size.  Treat invalid values
    as an error rather than entering an infinite loop.
    
    Reported by:    Synacktiv
    Reviewed by:    markj
    Security:       HYP-12
    Sponsored by:   The Alpha-Omega Project
    Sponsored by:   The FreeBSD Foundation
    Differential Revision: https://reviews.freebsd.org/D46134
---
 usr.sbin/bhyve/pci_hda.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/usr.sbin/bhyve/pci_hda.c b/usr.sbin/bhyve/pci_hda.c
index 8bd84a5113eb..97d6264413e0 100644
--- a/usr.sbin/bhyve/pci_hda.c
+++ b/usr.sbin/bhyve/pci_hda.c
@@ -788,6 +788,11 @@ hda_corb_run(struct hda_softc *sc)
 	int err;
 
 	corb->wp = hda_get_reg_by_offset(sc, HDAC_CORBWP);
+	if (corb->wp >= corb->size) {
+		DPRINTF("Invalid HDAC_CORBWP %u >= size %u", corb->wp,
+		    corb->size);
+		return (-1);
+	}
 
 	while (corb->rp != corb->wp && corb->run) {
 		corb->rp++;