From nobody Sat Sep 05 12:29:27 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hcXhR5Wsbz6rRkx for ; Sat, 05 Sep 2026 12:29:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hcXhR4pPvz3TVr for ; Sat, 05 Sep 2026 12:29:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788611367; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4VJzniBBBSBW5VcKbZB3NpeZ2IYqi8O3K+5cfRzJXdQ=; b=j3izCDoupsCPWK2G5yI6UfnRy00aAjbg7+iNQcAkjlyI3Xclo0LrLXeuNahkXZfiFI514t OmGyvTFmXLsU90oeS8b/B4xPClGp4JDpzRLuw/33awWg0JpiiMgY/v5jZBWW7ZTSfu4xqk 8Se2M08pub+UKRldRS6qo12PJ1ytH2EKCRYVr3myXpqBB93E/dAKJ3DJsvEQ15lP+sB6hD mZmhIY7pklEOkzpK6KChMO7tPrlMgFArR90bTBaWyH4dsTGp+itS6eZywuz3tUjkZAI6qH igIGwkgHMHQ5GC0aVtUKHQ1iJGX50Sc0fej1n1mumqwku0j7Ta4N7HP6c48y9g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788611367; a=rsa-sha256; cv=none; b=HajtKJTdgXolunlPrlt+PKXweKTxC6dUr3qrlQtxHijICreYEFKchbE2JWYNABNJXOrVQN l9Hp/DetbgjCTY+KVm1SdcBSP2NIF8ifh3Fd48hnkxYxE7cGTDFSxla/NsqMLQyAHlLpV/ KOFhf0NBCJcQgitKXB+ENlLxnr/acJLAngoTGYbyouMMIOqhgr0ovqLSwIFqjTZn+BbaaD JDejP/N4bEzL2qucGVByKPDUW0J458QDAfF1oA331F/4gP2c6bWhMpHPSkJge+NCf30KoA T1dGa5QgTjdl2XgibI2K7eC39qhgF/E1K9poTjBhsu/4LVmm+AkE5BidqYHsYQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788611367; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4VJzniBBBSBW5VcKbZB3NpeZ2IYqi8O3K+5cfRzJXdQ=; b=nDHix6CUJrH8eA7ZpPi2/M00VHYhKT8kuE7zBAH1gtckmL3oAE+rlRUdumQPqky+daU/oq atq5aK6pqnM5aTaF2a76+Oq+/1qlg5mCRRqc2K27STRFFfMDRLrYHcO17XCxYdTsSYnEzs Q1F54dcFHrYSyOrK7/sIjHbQihjLqtTC7GyglgXViK4305bW2qK2vYe4OZxn6vlUOpTEWB bg4Nz93MACfklYOeYQoqoxb2fkNzmm6gZ3A3WsGYX/B2X56+OIBDr6Xi/SFNvTcd6BOI9J 5N8Zj99DDfwNi964NUcxjiD1MAAQ9IrjMyvDOhlFVWW7xcfXmNl0Izlu1Y4acw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hcXhR3WCxzlyd for ; Sat, 05 Sep 2026 12:29:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22711 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 05 Sep 2026 12:29:27 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Christos Margiolis Subject: git: 3557da035532 - stable/15 - bhyve: Do not panic on invalid input in HDA emulation List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 3557da0355326ca1266d152c9df00a46bbb7ea92 Auto-Submitted: auto-generated Date: Sat, 05 Sep 2026 12:29:27 +0000 Message-Id: <6a9c0b27.22711.2c94da1@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=3557da0355326ca1266d152c9df00a46bbb7ea92 commit 3557da0355326ca1266d152c9df00a46bbb7ea92 Author: Christos Margiolis AuthorDate: 2026-08-22 12:48:32 +0000 Commit: Christos Margiolis CommitDate: 2026-09-05 12:29:22 +0000 bhyve: Do not panic on invalid input in HDA emulation The emulated HDA controller passed values taken from guest registers and from guest memory straight into assert(), so a guest could abort bhyve with values the emulation did not expect. Reject them instead. In case the guest asked to start something and it failed, clear the corresponding run/enable bit. PR: 256379, 256381, 256382, 256383, 256384, 256385, 256386, 256498 Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Reviewed by: bnovkov, jhb Differential Revision: https://reviews.freebsd.org/D59082 (cherry picked from commit f4d953bea74091874f019e3a2c4902dd013ee739) --- usr.sbin/bhyve/pci_hda.c | 55 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 18 deletions(-) diff --git a/usr.sbin/bhyve/pci_hda.c b/usr.sbin/bhyve/pci_hda.c index 97d6264413e0..92e347f641d9 100644 --- a/usr.sbin/bhyve/pci_hda.c +++ b/usr.sbin/bhyve/pci_hda.c @@ -612,14 +612,20 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind) uint8_t strm = 0; uint8_t dir = 0; - assert(!st->run); + if (st->run) { + DPRINTF("Stream 0x%x is already running", stream_ind); + return (-1); + } lvi = hda_get_reg_by_offset(sc, off + HDAC_SDLVI); bdpl = hda_get_reg_by_offset(sc, off + HDAC_SDBDPL); bdpu = hda_get_reg_by_offset(sc, off + HDAC_SDBDPU); + if (lvi >= HDA_BDL_MAX_LEN) { + DPRINTF("Invalid LVI: 0x%x", lvi); + return (-1); + } bdl_cnt = lvi + 1; - assert(bdl_cnt <= HDA_BDL_MAX_LEN); bdl_paddr = bdpl | (bdpu << 32); bdl_vaddr = hda_dma_get_vaddr(sc, bdl_paddr, @@ -637,7 +643,10 @@ hda_stream_start(struct hda_softc *sc, uint8_t stream_ind) bdle = (struct hda_bdle *)bdl_vaddr; for (size_t i = 0; i < bdl_cnt; i++, bdle++) { bdle_sz = bdle->len; - assert(!(bdle_sz % HDA_DMA_ACCESS_LEN)); + if ((bdle_sz % HDA_DMA_ACCESS_LEN) != 0) { + DPRINTF("Invalid BDLE length: 0x%x", bdle_sz); + return (-1); + } bdle_addrl = bdle->addrl; bdle_addrh = bdle->addrh; @@ -785,7 +794,6 @@ hda_corb_run(struct hda_softc *sc) { struct hda_codec_cmd_ctl *corb = &sc->corb; uint32_t verb = 0; - int err; corb->wp = hda_get_reg_by_offset(sc, HDAC_CORBWP); if (corb->wp >= corb->size) { @@ -801,8 +809,8 @@ hda_corb_run(struct hda_softc *sc) verb = hda_dma_ld_dword((uint8_t *)corb->dma_vaddr + HDA_CORB_ENTRY_LEN * corb->rp); - err = hda_send_command(sc, verb); - assert(!err); + if (hda_send_command(sc, verb) != 0) + DPRINTF("Fail to send verb: 0x%x", verb); } hda_set_reg_by_offset(sc, HDAC_CORBRP, corb->rp); @@ -928,13 +936,16 @@ static void hda_set_corbctl(struct hda_softc *sc, uint32_t offset, uint32_t old) { uint32_t value = hda_get_reg_by_offset(sc, offset); - int err; struct hda_codec_cmd_ctl *corb = NULL; if (value & HDAC_CORBCTL_CORBRUN) { if (!(old & HDAC_CORBCTL_CORBRUN)) { - err = hda_corb_start(sc); - assert(!err); + if (hda_corb_start(sc) != 0) { + DPRINTF("Fail to start CORB"); + hda_set_field_by_offset(sc, offset, + HDAC_CORBCTL_CORBRUN, 0); + return; + } } } else { corb = &sc->corb; @@ -948,12 +959,15 @@ static void hda_set_rirbctl(struct hda_softc *sc, uint32_t offset, uint32_t old __unused) { uint32_t value = hda_get_reg_by_offset(sc, offset); - int err; struct hda_codec_cmd_ctl *rirb = NULL; if (value & HDAC_RIRBCTL_RIRBDMAEN) { - err = hda_rirb_start(sc); - assert(!err); + if (hda_rirb_start(sc) != 0) { + DPRINTF("Fail to start RIRB"); + hda_set_field_by_offset(sc, offset, + HDAC_RIRBCTL_RIRBDMAEN, 0); + return; + } } else { rirb = &sc->rirb; memset(rirb, 0, sizeof(*rirb)); @@ -996,7 +1010,8 @@ hda_set_dpiblbase(struct hda_softc *sc, uint32_t offset, uint32_t old) if (!sc->dma_pib_vaddr) { DPRINTF("Fail to get the guest \ virtual address"); - assert(0); + hda_set_field_by_offset(sc, offset, + HDAC_DPLBASE_DPLBASE_DMAPBE, 0); } } else { DPRINTF("DMA Position In Buffer Reset"); @@ -1010,7 +1025,6 @@ hda_set_sdctl(struct hda_softc *sc, uint32_t offset, uint32_t old) { uint8_t stream_ind = hda_get_stream_by_offsets(offset, HDAC_SDCTL0); uint32_t value = hda_get_reg_by_offset(sc, offset); - int err; DPRINTF("stream_ind: 0x%x old: 0x%x value: 0x%x", stream_ind, old, value); @@ -1021,11 +1035,16 @@ hda_set_sdctl(struct hda_softc *sc, uint32_t offset, uint32_t old) if ((value & HDAC_SDCTL_RUN) != (old & HDAC_SDCTL_RUN)) { if (value & HDAC_SDCTL_RUN) { - err = hda_stream_start(sc, stream_ind); - assert(!err); + if (hda_stream_start(sc, stream_ind) != 0) { + DPRINTF("Fail to start stream 0x%x", + stream_ind); + hda_set_field_by_offset(sc, offset, + HDAC_SDCTL_RUN, 0); + } } else { - err = hda_stream_stop(sc, stream_ind); - assert(!err); + if (hda_stream_stop(sc, stream_ind) != 0) + DPRINTF("Fail to stop stream 0x%x", + stream_ind); } } }