From nobody Thu Oct 22 17:32:19 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j9YBD23pSz6xPgM for ; Thu, 22 Oct 2026 17:32:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j9YBC5j7kz3HXd for ; Thu, 22 Oct 2026 17:32:19 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690339; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bhITgrvQ+Ltr3Ar8lBsdv4bzrJ99d7YTh0MnZgrMBQw=; b=K15Rg9Mwr9crZhniV2U7z0vkYC7ljFCwbd8lE0otCdzSldNVFsf/qpssHY9rwlkU83bTm1 TjjXuQWnDlVeLGbPJZCH1gmkcvAVmDc6qUcewa4iwWpfjeQS9j0jhlPkyV3IMW7Tl6Zy8+ F1YY/vt+6TKChgfB4Vu1Ukrfoldbp+gVs2mUngmkUGkzLmhiUJhY4aZKe6fXVnJuo+xRn+ TdW2t0KzmvouciJxAI9Ac4WHjupdzWV+HiDNEdtNaUvzOSUk51xIHQBIdh7IE3g84LKFYT rPcpt/1G1Bh1r7PkWOCyfhhL3mAn8hi4x9BLKHyICAMWpp7fjkJ29zJ4qytO4Q== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792690339; b=UYdxu3NHEbWvy7urbK9+zpze21Px/LThgRTbZS65U8ZKltnoeq0tXepb6KgQi22dcmcjzL jvcGpHAJOCTO8u9feroAwa+lyPQHh90I7qJ4UTy6oVHmbLl4RtDok1FrlEA9Z/PSp20k8y AEpFwfqxXcDVsDyKoYjzJ/uHnW8ojo1FK9PWqvALSiz4tGiOvCE9OkckcII74BfmeZeApp LQq5KRN8d5vutCo33SJ0jd8J3xhPOZCkghTD9Rs4ftvp6J+2B7zxgJzGQPh5Ju49xYmGww +1M9SDeZBhgoLzOPLUfUWgQM9o24yqSyT4xTaudLGwK529otYcoJR7eretMhIA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690339; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bhITgrvQ+Ltr3Ar8lBsdv4bzrJ99d7YTh0MnZgrMBQw=; b=QLNNPEiMzHS0TOjQ3Pn2wXG6M2DikdT6LwQG3FPIfth/JlNwQ3qA/dMu2VQlX08z1QIGYk KkRajsYTDCRboO9wTqhzWgJgvdk1BbvCL18ZfSgy+djqMrS7HwGdMGAUs+cAtuDH1A3meF jQ7HeS0r77gCzl9evi42hjuFZGgqBJ/2GcoFQsAV5kJiOa0xGlL2Rc2V0WQ5GS5GGaLNQC Ylpb19Vro0XSxO7IKuQXyboVV3X4esKokprJAzo+eE30OP9WmLdsK5XPNFckDyKIVCLXkm mvOPgW1AiuWH3pHyAF2PT3eY/sb+4oxbK9dhYA649eUz7pqG0d2U7FmhMVJaFg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j9YBC4g98zsVw for ; Thu, 22 Oct 2026 17:32:19 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3c156 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 22 Oct 2026 17:32:19 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Hayzam Sherif From: Mark Johnston Subject: git: 2981c8a6491b - stable/15 - bhyve: Validate VirtIO queue guest addresses List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 2981c8a6491b360e6cb3e714eb6e7ec81dca8cab Auto-Submitted: auto-generated Date: Thu, 22 Oct 2026 17:32:19 +0000 Message-Id: <6ada48a3.3c156.2acd3e8b@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=2981c8a6491b360e6cb3e714eb6e7ec81dca8cab commit 2981c8a6491b360e6cb3e714eb6e7ec81dca8cab Author: Hayzam Sherif AuthorDate: 2026-09-30 14:17:24 +0000 Commit: Mark Johnston CommitDate: 2026-10-22 15:45:41 +0000 bhyve: Validate VirtIO queue guest addresses paddr_guest2host() returns NULL when a range does not fit within guest RAM. An unmappable queue address previously left the queue marked allocated with ring pointers computed from the failed mapping. Check the legacy virtqueue ring mapping before updating the queue state, and ignore an unmappable PFN write after printing a diagnostic. This leaves an unallocated queue unallocated and preserves an existing queue's PFN, ring pointers, flags, and indices. Also check the indirect descriptor table mapping before dereferencing it, returning an error if the table is unmappable, and ignore guest queue notifications for unallocated queues. Reviewed by: markj MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D59904 (cherry picked from commit 4485bfaed2145e88911bd3522d6fee5c0f8ceb39) --- usr.sbin/bhyve/virtio.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/usr.sbin/bhyve/virtio.c b/usr.sbin/bhyve/virtio.c index 304156bf7416..fa3c5f8e63a7 100644 --- a/usr.sbin/bhyve/virtio.c +++ b/usr.sbin/bhyve/virtio.c @@ -182,10 +182,15 @@ vi_vq_init(struct virtio_softc *vs, uint32_t pfn) char *base; vq = &vs->vs_queues[vs->vs_curq]; - vq->vq_pfn = pfn; phys = (uint64_t)pfn << VRING_PFN; size = vring_size_aligned(vq->vq_qsize); base = paddr_guest2host(vs->vs_pi->pi_vmctx, phys, size); + if (base == NULL) { + EPRINTLN("%s: queue %u has invalid GPA %#jx/%#zx", + vs->vs_vc->vc_name, vq->vq_num, (uintmax_t)phys, size); + return; + } + vq->vq_pfn = pfn; /* First page(s) are descriptors... */ vq->vq_desc = (struct vring_desc *)base; @@ -349,6 +354,13 @@ vq_getchain(struct vqueue_info *vq, struct iovec *iov, int niov, } vindir = paddr_guest2host(ctx, vdir->addr, vdir->len); + if (vindir == NULL) { + EPRINTLN( + "%s: indirect table GPA %#jx/%#x is " + "unmappable", name, (uintmax_t)vdir->addr, + (u_int)vdir->len); + return (-1); + } /* * Indirects start at the 0th, then follow * their own embedded "next"s until those run @@ -780,6 +792,8 @@ bad: goto done; } vq = &vs->vs_queues[value]; + if (!vq_ring_ready(vq)) + goto done; if (vq->vq_notify) (*vq->vq_notify)(DEV_SOFTC(vs), vq); else if (vc->vc_qnotify)